Forum Discussion

nov1ce_120072's avatar
nov1ce_120072
Icon for Nimbostratus rankNimbostratus
Jul 16, 2018

010c005b:5: Dropping a packet that is not a failover packet.

Hi,

A pair of BIG-IP LTM 3900 appliances running 12.1.2 build 0.0.249. This morning, for around a minute, /var/log/ltm was populated with:

Jul 16 08:00:46 F5-NODE01 notice sod[4940]: 010c005b:5: Dropping a packet that is not a failover packet.

Around the same time access to some VIPs was affected (FTP and SSH was timing out). I checked the connectivity between both units and couldn't identify any network interruption or flaps. No other entries present in the /var/log/ltm.

Any ideas would be greatly appreciated. According to K15310111 there shouldn't be any impact, although I'm not sure whether this is related.

Thank you.

2 Replies

  • Hi,

     

    You encountered this behaviour when The sod process detects and discards a malformed packet on a network failover interface or when you receives a packet that is not a failover packet. But in your case I thing it's du to malformed packet (especially if you have a dedicated vlan).

     

    As you know FTP and SSH (who put you in trouble too) are very sensitive in case of network problem (the slightest problem on the connection tcp can make you lose your session). did you check that there was no network problem during this time laps? Firewall/switch, ...

     

  • The only explanation would be that multiple HA packets were dropped or missed, a failover occurred, and you don't have connection mirroring, so you notice that with some applications that are stateful.

     

    Anyway, that should be clear in the logs.

     

    If that is important, open a case with F5 support to analyze the problem. Provide a qkview and full logs from both devices in the HA pair.