For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Amit585731's avatar
Amit585731
Icon for Nimbostratus rankNimbostratus
Oct 29, 2015

Regarding SYN flood attack

Hi ALL,   We are seeing SYN Cookie threshold exceeding on LTM while I think we are not seeing this huge connection from source so it can cross threshold limit of 16,384...   Internal warning tm...
application delivery
deployment
LTM
Brad_Parker's avatar
Brad_Parker
Icon for Cirrus rankCirrus
Oct 29, 2015

I don't think there is a SOL for it in the wild, but you need to turn off hardware SYN cookie protection for network virtual servers. It doesn't behave properly when turned on for anything other than a /32 destination virtual server. We had many problems with this last year and our local FSE finally confirmed it and sent out a newsletter detailing that it should be turned off. Software SYN cookie protection should get you by for those network VIPs. If not, contact your local F5 team. As soon as you disable hadrware SYN cookie in the TCP/FastL4 profile attached to the VS you should see things get better.

 

Brad_Parker's avatar
Brad_Parker
Icon for Cirrus rankCirrus
Oct 29, 2015
What usually triggers this erroneous behavior are packet drops up stream.