Forum Discussion

Aspirant

Aug 24, 2016

Solved

xt_TCPMSS: bad length (160 bytes) meaning

Hi, anyone has an idea what does this error mean:

Tue Aug 23 18:23:58 2016((GMT)) [SRX5308][Kernel][KERNEL] printk: 104130 messages suppressed.
Tue Aug 23 18:23:58 2016((GMT)) [SRX5308][Kernel][KERNEL] xt_TCPMSS: bad length (160 bytes)

Firewall got flooded with it.

Security

Solutions

Edivas
Aug 26, 2016
Ok, found an answer what was the cause of it. In my case this was a ddos attack on our servers. I quess it overfilled the firewall with packets or connections. I enabled session limitting then and logs showed connetions from different adreses. That didn't help of course... still got locked out. Only checked the logs when it stopped.
Thanks

6 Replies

JohnRo
NETGEAR Employee Retired
Aug 25, 2016
Hello Edivas,

Welcome to the community!

I'm not familiar with the error message you are getting, doing a search online shows different causes on why the error shows up. What changes have you made to the firewall/network before you got this error? How old is the router?

Thanks,
- Edivas
  Aspirant
  Aug 26, 2016
  Ok, found an answer what was the cause of it. In my case this was a ddos attack on our servers. I quess it overfilled the firewall with packets or connections. I enabled session limitting then and logs showed connetions from different adreses. That didn't help of course... still got locked out. Only checked the logs when it stopped.
  Thanks
  - JohnRo
    NETGEAR Employee Retired
    Aug 26, 2016
    Hi Edivas,
    
    I see. Try enabling "Block TCP flood", you can find this settin in Security>Firewall>Attack checks. See if this will help.
    
    Thanks,