SRX

Expand all | Collapse all

Cannot identify Log message RT_FLOW: FLOW_REASSEMBLE_FAIL: FCB ageout before all fragments arrive

Jump to Best Answer
  • 1.  Cannot identify Log message RT_FLOW: FLOW_REASSEMBLE_FAIL: FCB ageout before all fragments arrive

     
    Posted 06-15-2017 07:43

    I am showing hundreds of logs showing the following:

     

     RT_FLOW: FLOW_REASSEMBLE_FAIL: FCB ageout before all fragments arrive, source 5.6.7.8 destination 1.2.3.4 ipid 7700

     

    The destination address is our public IP but the source is always different suggesting a possible DDOS attack. Can anyone explain what this log means including the "ipid"?

     

     



  • 2.  RE: Cannot identify Log message RT_FLOW: FLOW_REASSEMBLE_FAIL: FCB ageout before all fragments arrive
    Best Answer

     
    Posted 06-15-2017 10:44

    Hello,

     

    FCB is a data structure used to reassembey and forward fragments. Every fragmented packet has same IP addresses and same IPID and based on this FCB is able to reassemble the fragments into one packet
    when it receives them. FCB has a timeout of 3 seconds and if all fragments of a packets are not received by FCB in 3 seconds, fragment will age out and will get dropped with the message that you see.

     

    Is there any pattern with source IP that you see?

    Are the source IP addresses unknown?

     

    Regards,

     

    Rushi



  • 3.  RE: Cannot identify Log message RT_FLOW: FLOW_REASSEMBLE_FAIL: FCB ageout before all fragments arrive

     
    Posted 06-15-2017 15:34

    Hi rtilak, thanks for the response.

     

    Yes the source IPs are unknown. Can this be limited with a screen option such as ‘tcp syn-flood destination threshold’ or ‘limit-session destination-ip-based’?



  • 4.  RE: Cannot identify Log message RT_FLOW: FLOW_REASSEMBLE_FAIL: FCB ageout before all fragments arrive

     
    Posted 06-15-2017 19:51

    Hello,

     

    That can be tried or if the IP addresses are unknown but repeatitive or with a pattern you can use firewall filter to block.

     

    Regards,

     

    Rushi



  • 5.  RE: Cannot identify Log message RT_FLOW: FLOW_REASSEMBLE_FAIL: FCB ageout before all fragments arrive

     
    Posted 06-16-2017 02:29

    Applied a screen with UDP flood and this seems to have solved the problem. We now see:

     

    RT_IDS: RT_SCREEN_UDP: UDP flood!

     

    Thanks



  • 6.  RE: Cannot identify Log message RT_FLOW: FLOW_REASSEMBLE_FAIL: FCB ageout before all fragments arrive

    Posted 02-01-2018 11:44

    What is the traffic is valid and it is causing issues.  In my case this is DNS replies from the internet.



  • 7.  RE: Cannot identify Log message RT_FLOW: FLOW_REASSEMBLE_FAIL: FCB ageout before all fragments arrive

    Posted 11-14-2018 04:57

    I'd like to know the answer to this as well.  We are beginning to use certain devices that will not work because of this setting.  The vendor specifies that fragmented packets do not get dropped.  Is there a way to either exclude a certain IP address from this protection or tweak the timing?