HTTP Profile "Maximum Header Size"

Question

Hi All,&nbsp;

&nbsp;
&nbsp;

Our platform is intended to act as a proxy or transparent
proxy to serve ONLY http traffic from handset or laptop. (Non http traffic bypassed at F5 level)&nbsp;

&nbsp;
&nbsp;
After we putting live production traffic to platform, there are lots of HTTP header size error logged and causing the F5 stop sending traffic to one of the pool member.&nbsp;
We tried to increase the size to 64KB and it's error still keep logging in /var/log/ltm.&nbsp;
To avoid downtime, we had the "Maximum Header Size" disabled in HTTP profile.&nbsp;
Please see below for the error log.&nbsp;
&nbsp;

History log:

&nbsp;

Jan  4 23:58:53 local/tmm err tmm[5238]: 011f0005:3: HTTP
header (33304) exceeded maximum allowed size of 32768 (Client side: vip=ext_HTTP_VS_80
profile=http pool=Pool_3128)&nbsp;
Jan  4 23:58:54 local/tmm1 err tmm1[5239]: 011f0005:3: HTTP
header (33304) exceeded maximum allowed size of 32768 (Client side:
vip=ext_HTTP_VS_80 profile=http pool=Pool_3128)&nbsp;
Jan  4 23:58:55 local/tmm3 err tmm3[5241]: 011f0005:3: HTTP
header (33304) exceeded maximum allowed size of 32768 (Client side:
vip=ext_HTTP_VS_80 profile=http pool=Pool_3128)&nbsp;
Jan  4 23:58:55 local/tmm err tmm[5238]: 011f0005:3: HTTP
header (33304) exceeded maximum allowed size of 32768 (Client side:
vip=ext_HTTP_VS_80 profile=http pool=Pool_3128)&nbsp;

&nbsp;
I need advice on inquiry below:&nbsp;
1.Is this a critical messages?&nbsp;
2.If particular VS hitting too much of this error, what is the expected F5 behavior? stop sending traffic to one of the pool member?&nbsp;
3.Need input from your security point of view, what value is best approach?&nbsp;
4.If we disable “Maximum Header Size” checking, will it cause security issue? Like DOS attack?&nbsp;
Thanks,&nbsp;
chiewming&nbsp;

&nbsp;
&nbsp;

&nbsp;
&nbsp;
&nbsp;

hoolio · Answer

Hi Chiewming, 
  
 See below for more info: 
  
 1.Is this a critical messages? 
 When this error occurs, TMM resets the client connection. 
  
 2.If particular VS hitting too much of this error, what is the expected F5 behavior? stop sending traffic to one of the pool member? 
 See above.  There is no impact on the pool members.  TMM simply resets the client connection.  Increasing the max headers size in the HTTP profile will force TMM to allocate more memory to store the HTTP headers though. 
  
 3.Need input from your security point of view, what value is best approach? 
 I'd increase the max size in the HTTP profile and use an iRule to log the request details.  You can then determine whether the request is malicous, from a poorly designed client or incorrect web app behavior. 
  
 4.If we disable “Maximum Header Size” checking, will it cause security issue? Like DOS attack? 
 This setting can't be disabled, but you could set it to a very large value.  I wouldn't recommend this though as you'll eat up more TMM memory. 
  
 Here's an iRule you can use to log long header values. Note that the HTTP profile setting for Max HTTP headers size must be greater than the actual request's headers in order to avoid being reset and trigger the HTTP_REQUEST event. This version checks the total headers size before looping through each header.

when HTTP_REQUEST {

Check the total HTTP headers size
if {[string length [HTTP::request]] &gt; 10000 }{

Check if the URI is very long
if {[string length [HTTP::uri]] &gt; 1000}{

log local0. "Uri is long. Length [string length [HTTP::uri]], URI: [HTTP::uri]"

Exit this event from this iRule
return
}

Loop through the headers by name
foreach header {[HTTP::header names]} {

Check for a long header value
if {[string length [HTTP::header value $header]] &gt; 1000 } { 
log local0. "Header is long. Header Name: $header,\
Length: [string length [HTTP::header value $header]], Value: [HTTP::header value $header]" 
 Exit this event from this iRule
return
}
}

If we are still here the request was large, but not the URI or any single header.
 Log the first 1k bytes of the full request
log local0. "Request is long: [HTTP::request]"
}
}

Aaron

chiewming_15294 · Answer

Hi Aaron, 
&nbsp;  
&nbsp; Thanks for your prompt reply. 
&nbsp;  
&nbsp; I need some advice on question below :  
&nbsp; 1)When you say TMM reset the connection, it's mean client need resend http request again? 
&nbsp; 2)Is "Maximum Header Size" applicable to only client http request? other http activity?  
&nbsp; 3)TMM check on the packet's "Header length" for the size or TMM does calculate on the header size? 
&nbsp; 4)Regarding your reply on question (4), it thought it can be disabled by uncheck the check box in Local Traffic -&gt; Profiles -&gt; Services -&gt; HTTP -&gt; *my_http_profile* ? 
&nbsp; 5)What could be the cause of larger http header size other than web application/URI behavior? 
&nbsp; 6) I read on some F5 article saying that DOS attack could make use of this to create spamming if value set too high. 
&nbsp;  
&nbsp; Thanks in advance. 
&nbsp;  
&nbsp; Regards, 
&nbsp; chiewming 
&nbsp;  &nbsp;

chiewming_15294 · Answer

Any update?  
&nbsp;  
&nbsp; Thanks, 
&nbsp; chiewming

hoolio · Answer

1) When you say TMM reset the connection, it's mean client need resend http request again? 
&nbsp; TMM sends the client a TCP reset. This would result in a failure of the current HTTP request and the client would need to hit refresh to resubmit the request.  If they send the same request with a large HTTP header set, they would receive another reset. 
&nbsp;  
&nbsp; 2) Is "Maximum Header Size" applicable to only client http request? other http activity? 
&nbsp; The max header size is checked for the HTTP request headers only as far as I'm aware. 
&nbsp;  
&nbsp; 3) TMM check on the packet's "Header length" for the size or TMM does calculate on the header size? 
&nbsp; TMM calculates it based on the start of the HTTP headers up until the first 

 sequence which ends the headers. 
&nbsp;  
&nbsp; 4) Regarding your reply on question (4), it thought it can be disabled by uncheck the check box in Local Traffic -&gt; Profiles -&gt; Services -&gt; HTTP -&gt; *my_http_profile* ? 
&nbsp; No.  That would just use the default HTTP profile's value for max header size. 
&nbsp;  
&nbsp; 5) What could be the cause of larger http header size other than web application/URI behavior? 
&nbsp; It could be a malicious client, a poorly designed client or incorrect web app behavior. 
&nbsp;  
&nbsp; 6) I read on some F5 article saying that DOS attack could make use of this to create spamming if value set too high. 
&nbsp; Yes, but I don't think it's much of a risk if you temporarily raise the limit even to 64KB in order to log details of the request and fix the issue. 
&nbsp;  
&nbsp; Aaron

chiewming_15294 · Answer

Great. Thanks Aaron... 
&nbsp;  
&nbsp; Another question :( 
&nbsp;  
&nbsp; Currently,we have a few iRule associate with the virtual server and average is about 25% CPU load. 
&nbsp; Will this iRule cause additional check for each and every request and increase te CPU load?  
&nbsp;  
&nbsp; Any pros or cons you can think off other then the resource loading? 
&nbsp;  
&nbsp; Thanks, 
&nbsp; chiewming

Forum Discussion

SSO Login Update Coming to DevCentral

Kevin - June 2026 Featured F5er

Tyler - May 2026 Featured Member

Recent Discussions

What configuration issue am I experiencing with this 130-domain VS ?

F5 System Scanner - How I deployed it at scale

Ivanti MDM Core & F5 LTM/ASM with mTLS

F5 BIGIP & XC certbot plugin

Hardware BIG-IP appliance reach EOSS, but the software version running on it not yet?