Syncookie Activation/Deactivation

Hello,

 

We had Hardware syncookie activate two days ago on a fast-l4 forwarding gateway. The gateway in question is n-pathish and we have loose initiation and loose close enabled on these vlans. Once it was activated on this vlan it reaked havoc on the traffic, until we realized what had happened. We have since disabled Hardware Syncookie in the Fast-L4 profile, which has resolved the traffic issue, but the F5 still believes that a syn flood is still occurring. I have done numerous packet captures on this vlan interface, but from what I can see all the traffic appears to be legitimate, and all syn packets had corresponding acks.

 

Any suggestions that might help me track down exactly why the Syncookie is still activated on this vlan?

 

Terry