xt_TCPMSS: bad length (160 bytes) meaning

[Edivas]

Hi, anyone has an idea what does this error mean:

Tue Aug 23 18:23:58 2016((GMT)) [SRX5308][Kernel][KERNEL] printk: 104130 messages suppressed.
Tue Aug 23 18:23:58 2016((GMT)) [SRX5308][Kernel][KERNEL] xt_TCPMSS: bad length (160 bytes)

Firewall got flooded with it.

[Edivas · Accepted solution]

Ok, found an answer what was the cause of it. In my case this was a ddos attack on our servers. I quess it overfilled the firewall with packets or connections. I enabled session limitting then and logs showed connetions from different adreses. That didn't help of course... still got locked out. Only checked the logs when it stopped.

Thanks

[JohnRo]

Hello Edivas, 

Welcome to the community! 

I'm not familiar with the error message you are getting, doing a search online shows different causes on why the error shows up. What changes have you made to the firewall/network before you got this error? How old is the router? 

Thanks, 

[Edivas · Accepted solution]

Ok, found an answer what was the cause of it. In my case this was a ddos attack on our servers. I quess it overfilled the firewall with packets or connections. I enabled session limitting then and logs showed connetions from different adreses. That didn't help of course... still got locked out. Only checked the logs when it stopped.

Thanks

[JohnRo]

Hi Edivas,

I see. Try enabling "Block TCP flood", you can find this settin in Security>Firewall>Attack checks. See if this will help. 

Thanks, 

[Edivas]

"Block TCP flood" was enabled and set up at 40 packets per second, but it didn't help. Unless i need to set it to even lower value?

[JohnRo]

Hi Edivas, 

I suggest contacting Support for this issue to be looked at. It's possible that it needs to be escalated to engineering. 

Thanks, 

[DaneA]

Hi Edivas,

Were you able to open an online case with NETGEAR Support for further assistance?  If yes, keep us posted about the progress of your online case.

Regards,

DaneA

NETGEAR Community Team