For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

changewait1's avatar
changewait1
Icon for Altostratus rankAltostratus
May 20, 2025

About DNS irule TCL error

Hi everyone,

I'm encountering a TCL error when using an iRule on my BIG-IP DNS (GSLB) system. The error appears as follows:

 err tmm9[13024]: 01220001:3: TCL error: /Common/IRULE_LOGGING_RESPONSE <DNS_RESPONSE> - Packet alloc for section failure. invoked from within "DNS::answer"

iRule

when DNS_RESPONSE { set timestamp [clock format [clock seconds] -format "%Y-%m-%d %H:%M:%S"] # log local0. "Client IP : [IP::client_addr] / F5 answer : [DNS::answer]" set kt_hsl [HSL::open -publisher /Common/kt_publisher] HSL::send $kt_hsl "$timestamp DNS RESPONSE / Client IP : [IP::client_addr] / F5 answer : [DNS::answer]" 

My questions:
What causes the "Packet alloc for section failure" error when calling DNS::answer?
Is there a way to safely call DNS::answer only when the response is valid?
if the iRule is indeed causing this error, how should I modify it to avoid the issue?

Any insights, workarounds, or documentation references would be greatly appreciated.

Thanks in advance!

irule

3 Replies

  • Injeyan_Kostas's avatar
    Injeyan_Kostas
    Icon for Nacreous rankNacreous
    May 20, 2025

    You should use catch function

    try something like this

    when DNS_RESPONSE 
{ 
	set timestamp [clock format [clock seconds] -format "%Y-%m-%d %H:%M:%S"] 
	# log local0. "Client IP : [IP::client_addr] / F5 answer : [DNS::answer]" 
	set kt_hsl [HSL::open -publisher /Common/kt_publisher] 
	
	if {[catch {HSL::send $kt_hsl "$timestamp DNS RESPONSE / Client IP : [IP::client_addr] / F5 answer : [DNS::answer]"}]} 
	{
        log local0. "ERROR: DNS RESPONSE FAILED"
    }
}

     

    • changewait1's avatar
      changewait1
      Icon for Altostratus rankAltostratus
      May 21, 2025

      Thanks for your help.
      Than, is the log issue caused by the failure of HSL::send due to a DNS RESPONSE failure?
      If so, is it possible to identify the cause of the DNS RESPONSE failure through logs?

      • Injeyan_Kostas's avatar
        Injeyan_Kostas
        Icon for Nacreous rankNacreous
        May 21, 2025

        The problem was that [DNS::answer] was't include a valid or parseable answer

        You may collect the payload to check what is wrong