Users roaming between wireless access points see DNS failures only when DNS over TLS (TCP/853) is used. Normal DNS over UDP/53 works fine.

The EX2300 access switches were suspected of “injecting data into the SYN packet,” because SSR IDP was dropping these flows with an attack like TCP: C2S Ambiguity Data in SYN Packet / CVE-2021-28319 on traffic to public DNS (e.g. 8.8.4.4:853).

Issue appears only when clients use DNS over TLS (TCP/853) to servers like 8.8.4.4 / 8.8.8.8. Standard DNS over UDP/53 works without packet drops.

Affected users often report:

• No connectivity / name resolution after roaming to certain APs (e.g. specific area/R&D).
• Connection sometimes recovers after forgetting and rejoining the SSID.

On the SSR:

• IDP logs show drops for traffic from client subnets to 8.8.4.4 or 8.8.8.8 on port 853 with an attack vector similar to:

-- TCP: C2S Ambiguity Data in SYN Packet / CVE-2021-28319

-- TCP:C2S:AMBIG:C2S-SYN-DATA

Packet captures, however, show that:

• The client is sending TCP SYN packets with payload (Len≈228) from the start.
• This is expected TCP Fast Open behavior, where the TLS Client Hello is piggybacked on the SYN for DNS over TLS to reduce RTT.
• The EX2300 is just bridging the frames and is not modifying or adding TCP payload.

The SSR’s IDP engine sees “data in SYN” and classifies it as suspicious (TCP:C2S:AMBIG:C2S-SYN-DATA), then drops the connection. Both the client and SSR are acting as designed; this is not a switch defect.

Customer Success team is suggesting that you should configure a new policy on SSR for 8.8.4.4 & 8.8.8.8 and dest port 853 and do not set any IDP rule to it, which will be allowed through the SSR. So far, it does not seem to be a switch/EX2300 issue.

If the EX2300 switch is doing pure layer-2 switching:

• It does not terminate TCP sessions.
• won't Rewrite TCP headers
• won't Add/remove TCP payload

It should only modify

• Layer-2 headers (MACs, VLAN tags, CoS bits)
• Possibly encapsulation (Q-in-Q, etc.), but never the L4 payload. 

There is no feature on EX2300 that “injects" data into the SYN packet.