Description

customer is observing below logs in the router and looking for explanation.

May 4 14:30:01.343 PTX10001-36mr-router kernel: [jtd_handle_tcp_syn:885] Server entry not found for syn: VRF: 0
May 4 14:30:01.629 PTX10001-36mr-router kernel: [jtd_handle_tcp_syn:885] Server entry not found for syn: VRF: 0

Please clarify the source/dest packet TCP DDoS attack.
We need to identify the source of the DDoS attack and confirm that this log does not impact my customer service 

Symptoms

Following logs will be seen continuously and its not due to any DDOS attack

 kernel: [jtd_handle_tcp_syn:885] Server entry not found for syn: VRF: 0

Solution

The Software log ERR in question occurs when an incoming TCP SYN is received and there is no application listening on the destination TCP port.

This SW log ERR has been removed as of 22.4-EVO with the JTD Linux tracepoint-backed error statistic UpcallSynFail which can be viewed via "cat /proc/net/jtdstats" or "cli show system statistics jtd

This is non-service impacting log messages and in future release these logs were better handled. So EVO release prior to this 22.4 will receive this unproperly handled JTD log error.

 

 

Modification History

2024-08-14 : Article Created