08-28-2023 05:06 PM
Hi everyone,
i'm receive the follow messages in th twistlock-defender
[31m ERRO 2023-08-01T14:46:18.613 tracker_network_nfqueue.go:378 [0m NFQueue packet processing total errors: 70, errors: [2023-08-01T14:30:00.547 failed to append twistlock options in host egress packet of [172.25.208.1:20074 -> 172.25.2.39:6443]: too many options (len: 32, packet len: 72): 0204ffd70402080a85219e5700000000010303071f0c000012400003ca889eba <nil> 2023-08-01T14:40:00.487 failed to append twistlock options in host egress packet of [172.25.208.1:9524 -> 172.25.2.38:6443]: too many options (len: 32, packet len: 72): 0204ffd70402080a852ac5db00000000010303071f0c000012400000f7f96a83 <nil> 2023-08-01T14:44:30.377 failed to append twistlock options in host egress packet of [172.25.74.187:50212 -> 172.25.2.39:6443]: too many options (len: 32, packet len: 72): 020405a00402080a67932c5100000000010303071f0c0007e000000178de8835 <nil> 2023-08-01T14:44:30.385 failed to append twistlock options in host egress packet of [172.25.74.187:50218 -> 172.25.2.38:6443]: too many options (len: 32, packet len: 72): 020405a00402080a67932c5900000000010303071f0c0007e000000178de8835 <nil> 2023-08-01T14:44:30.639 failed to append twistlock options in host egress packet of [172.25.74.187:50234 -> 172.25.2.39:6443]: too many options (len: 32, packet len: 72): 020405a00402080a67932d5600000000010303071f0c0007e000000178de8835 <nil>]
Any idea?
Best
08-31-2023 04:16 PM
Hi Humberto,
I hope you're doing well. Based on the error message, it seems that the options length is too long to be appended to the host egress packet, and it's resulting in errors. This seems to be expected behavior if you enable network monitoring feature, it essentially enable partial feature of CNNF( now CNNS)
Typically, when the iptables receives a header longer than 32 it will drop the connection, essentially killing that from ever reestablishing
The proper protocol and my recommendation is to open a support ticket and be sure to provide the Defender support information
If possible, also include with the ticket the iptables rules programed at the host with and without CNNS
Thank you,
08-31-2023 04:16 PM
Hi Humberto,
I hope you're doing well. Based on the error message, it seems that the options length is too long to be appended to the host egress packet, and it's resulting in errors. This seems to be expected behavior if you enable network monitoring feature, it essentially enable partial feature of CNNF( now CNNS)
Typically, when the iptables receives a header longer than 32 it will drop the connection, essentially killing that from ever reestablishing
The proper protocol and my recommendation is to open a support ticket and be sure to provide the Defender support information
If possible, also include with the ticket the iptables rules programed at the host with and without CNNS
Thank you,
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
