For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

shawn306_84070's avatar
shawn306_84070
Icon for Nimbostratus rankNimbostratus
Jan 21, 2010

LTM messages

Very strange to be getting these messages since none of these ips touch the F5

 

 

Jan 21 16:26:54 local/tmm1 notice tmm1[2517]: 01200004:5: Packet rejected remote IP 10.73.0.105 port 0 local IP 10.69.21.83 port 3 proto ICMP: Port closed.

 

Jan 21 16:26:56 local/tmm1 notice tmm1[2517]: 01200004:5: Packet rejected remote IP 10.73.0.201 port 0 local IP 216.18.209.131 port 3 proto ICMP: Port closed.

 

 

I looked at SOL 8009 and tried that but that didn't seem to work.

 

 

Any thoughts on why I would be getting these messages.

 

 

Thanks

 

 

Shawn
config
design

2 Replies

  • The_Bhattman's avatar
    The_Bhattman
    Icon for Nimbostratus rankNimbostratus
    Jan 21, 2010
    Hi Shawn,

     

    I had the same issue long time ago. I reloaded the box after I perforeme SOL 8009 it went away. Perhaps that is what you need to do?

     

     

    Bhattman
  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Jan 21, 2010
    Hi Shawn,

     

     

    I'd guess it's traffic that is hitting LTM but on an IP which isn't defined or enabled. If you're doubting that the traffic is hitting LTM, you could run tcpdump on 0.0 or eth0 filtering on the source IP to see:

     

     

    tcpdump -ni 0.0 -Xs0 host 10.73.0.105

     

     

    216.18.209.131 seems to be an LA colo address serving a default apache page. Odd...

     

     

    Aaron