twistlock-defender nfqueue errors

HumbertoNeves — Tue, 29 Aug 2023 00:06:37 GMT

Hi everyone,

i'm receive the follow messages in th twistlock-defender

[31m ERRO 2023-08-01T14:46:18.613 tracker_network_nfqueue.go:378 [0m NFQueue packet processing total errors: 70, errors: [2023-08-01T14:30:00.547 failed to append twistlock options in host egress packet of [172.25.208.1:20074 -> 172.25.2.39:6443]: too many options (len: 32, packet len: 72): 0204ffd70402080a85219e5700000000010303071f0c000012400003ca889eba <nil> 2023-08-01T14:40:00.487 failed to append twistlock options in host egress packet of [172.25.208.1:9524 -> 172.25.2.38:6443]: too many options (len: 32, packet len: 72): 0204ffd70402080a852ac5db00000000010303071f0c000012400000f7f96a83 <nil> 2023-08-01T14:44:30.377 failed to append twistlock options in host egress packet of [172.25.74.187:50212 -> 172.25.2.39:6443]: too many options (len: 32, packet len: 72): 020405a00402080a67932c5100000000010303071f0c0007e000000178de8835 <nil> 2023-08-01T14:44:30.385 failed to append twistlock options in host egress packet of [172.25.74.187:50218 -> 172.25.2.38:6443]: too many options (len: 32, packet len: 72): 020405a00402080a67932c5900000000010303071f0c0007e000000178de8835 <nil> 2023-08-01T14:44:30.639 failed to append twistlock options in host egress packet of [172.25.74.187:50234 -> 172.25.2.39:6443]: too many options (len: 32, packet len: 72): 020405a00402080a67932d5600000000010303071f0c0007e000000178de8835 <nil>]

Any idea?

Best

Re: twistlock-defender nfqueue errors

WLejulus — Thu, 31 Aug 2023 23:16:29 GMT

Hi Humberto,

I hope you're doing well. Based on the error message, it seems that the options length is too long to be appended to the host egress packet, and it's resulting in errors. This seems to be expected behavior if you enable network monitoring feature, it essentially enable partial feature of CNNF( now CNNS)

Typically, when the iptables receives a header longer than 32 it will drop the connection, essentially killing that from ever reestablishing

The proper protocol and my recommendation is to open a support ticket and be sure to provide the Defender support information

What defender version are you running?
What type of defender is it
The full defender log...

If possible, also include with the ticket the iptables rules programed at the host with and without CNNS

Thank you,

topic Re: twistlock-defender nfqueue errors in Prisma Cloud Discussions

twistlock-defender nfqueue errors

Re: twistlock-defender nfqueue errors