For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Pael_74584's avatar
Pael_74584
Icon for Nimbostratus rankNimbostratus
Mar 05, 2009

RST packet size

Hi, I'm quite puzzled why I am having this logs. Checked TCP dump, no one seems attacking my LTM.     Mar 5 20:02:03 tmm tmm[1132]: 011e0001:4: Limiting open port RST response from 266 to ...
config
design
hoolio's avatar
hoolio
Icon for Cirrostratus rankCirrostratus
Mar 06, 2009
This alert is described in SOL9259 (Click here). LTM is limiting the rate of sending RST packets (not the size) in response to requests to invalid IP address:port combinations. If you're seeing the alert actively logged, you should see a large number of invalid TCP packets coming in. It would be ideal if F5 could provide the destination IP:port but it might not be tracked in that level of detail.

 

 

Aaron