TCP exceeds 100 burst packets

b_g — Wed, 29 Jan 2025 13:34:01 GMT

Hi there

I've stumbled across following log entry on one of our ICX7450-24 (running 08.0.90mcT213):

N:TCP: Local TCP exceeds 100 burst packets, stopping for 10 seconds!!

This is a single event that just popped up. My research wasn't really successful. Does somebody know what that entry means and why it occurs?

Re: TCP exceeds 100 burst packets

MariaC862 — Fri, 31 Jan 2025 16:32:20 GMT

Hello!

Thank you for your post, here the info about that alert:

Message Level

Notification

Message

Local TCP exceeds num burst packets, stopping for num seconds!!

Explanation

Threshold parameters for local TCP traffic on the device have been configured, and the maximum burst size for TCP packets has been exceeded.

The first num is the maximum burst size (maximum number of packets allowed).

The second num is the number of seconds during which additional TCP packets will be blocked on the device.

Note: This message can occur in response to an attempted TCP SYN attack.

Please check this article:
How to Prevent a TCP SYN Attack?

And this command: ip tcp burst-normal

I hope that helps!

topic TCP exceeds 100 burst packets in ICX Switches

TCP exceeds 100 burst packets

Re: TCP exceeds 100 burst packets