For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Ecesureshkumar's avatar
Ecesureshkumar
Icon for Nimbostratus rankNimbostratus
Aug 01, 2016

Syncookie threshold 1994 exceeded

Hi team,   We have BIG IP LTM device in cluster for our production system, we are receiving below error message during peak window and suspect some of genuine connections are getting dropped due t...
application delivery
big-ip ltm
LTM
PeteWhite's avatar
PeteWhite
Icon for Employee rankEmployee
Aug 08, 2016

You should read the following article that provides further information SOL14779: Overview of BIG-IP SYN cookie protection (11.3.x - 12.x)

 

You should note that the settings are per tmm so would trigger at a lower than expected rate when traffic is pinned to a single tmm such as from a limited range of IP addresses.

 

Configuration of the global threshold is at System>Configuration>Local Traffic>General ( SYN Check™ Activation Threshold ) and is set to 16384 by default. Try doubling it to 32768 first and see whether it still triggers. You can further narrow this down if you want to.