For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

santosh_81454's avatar
santosh_81454
Icon for Nimbostratus rankNimbostratus
Jan 19, 2012

Error : .tcp_parse_options: Illegal window scaling value 109 >14

Hello, we have two 5100 bigip units running v9.1.2. Recently we started receiving the error message as below under the /var/log/messages file. When this message occurs, the LTM stops processing traffic. The pool members will be shown up, but any ping attempts to the servers fails. All traffic processing is stopped. We checked the pcaps and qkview and couldnt identify anything specific. The only options support provides was to upgrade.

 

 

 

 

If anyone faced similar issues, please reply and kindly share the fix if possible.

 

 

 

Error:

 

************************

 

Jan 18 04:27:36 g value 109 >14 received.tcp_parse_options: Illegal window scaling value 109 >14 received.tcp_parse_options: Illegal window scaling value 109 >1

 

4 received.tcp_parse_options: Illegal window scaling value 109 >14 received.tcp_parse_options: Illegal window scaling value 109 >14 received.tcp_parse_options: Illegal

 

window scaling value 109 >14 received.tcp_parse_options: Illegal window scaling value 109 >14 received.tcp_parse_options: Illegal window scaling value 109 >14 received.

 

tcp_parse_options: Illegal window scaling value 109 >14 received.tcp_parse_options: Illegal window scaling value 109 >14 received.tcp_parse_options: Illegal window scal

 

ing value 109 >14 received.tcp_parse_options: Illegal window scaling value 78 >14 received.tcp_parse_options: Illegal window scaling value 109 >14 received.tcp_parse_op

 

tions: Illegal window scaling value 109 >14 received.tcp_parse_options: Illegal window scaling value 109 >14 received.tcp_parse_options: Illegal window scaling value 15

 

5 >14 received.tcp_parse_options: Illegal window scaling value 159 >14 received.tcp_parse_options: Illegal window scaling value 47 >14 received.tcp_parse_options: Illeg

 

al window scaling value 109 >14 received.tcp_parse_options: Illegal window scaling value 109 >14 received.tcp_parse_options: Illegal window scaling value 109 >14 receiv

 

ed.tcp_parse_options: Illegal window scaling value 109 >14 received.tcp_parse_options: Illegal window scaling value 109 >14 received.tcp_parse_options: Illegal window s

 

caling value 109 >14 received.tcp_parse_options: Illegal window scaling value 109 >14 received.tcp_parse_options: Illegal window scaling value 47 >14 received.tcp_parse

 

_options: Illegal window scaling value 109 >14 received.tcp_parse_options: Illegal window scaling value 109 >14 received.tcp_parse_options: Illegal window scaling value

 

109 >14 received.tcp_parse_options: Illegal window scaling value 109 >14 received.tcp_parse_options: Illegal window scaling value 163 >14 received.tcp_parse_options: I

 

llegal window scaling value 109 >14 received.tcp_parse_o

 

************************

 

 

 

Thanks,

 

Santosh.

 

management
monitoring

1 Reply

  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Jan 19, 2012
    Hi Santosh,

     

     

    The only reference I could find to that illegal window scaling value error is from a single case where the escalation engineer suggested this was an issue with a host on the network not supporting RFC 1323 for window scaling.

     

     

    I don't know what the actual issue is or whether an upgrade would improve LTM's handling of it. But the 5100 platform can run 9.3.x or 9.4.x. If you had support on the unit as of 2007-10-09 you could upgrade the unit to 9.3.1. For 9.4.8 you'd need to have had support for the unit on 2009-05-27. See SOL7717 for details:

     

     

    http://support.f5.com/kb/en-us/solutions/public/7000/700/sol7727.html

     

     

    Aaron