twistlock-defender nfqueue errors

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

twistlock-defender nfqueue errors

L1 Bithead

Hi everyone, 

 

i'm receive the follow messages in th twistlock-defender

 ERRO 2023-08-01T14:46:18.613 tracker_network_nfqueue.go:378  NFQueue packet processing total errors: 70, errors: [2023-08-01T14:30:00.547 failed to append twistlock options in host egress packet of [172.25.208.1:20074 -> 172.25.2.39:6443]: too many options (len: 32, packet len: 72): 0204ffd70402080a85219e5700000000010303071f0c000012400003ca889eba <nil> 2023-08-01T14:40:00.487 failed to append twistlock options in host egress packet of [172.25.208.1:9524 -> 172.25.2.38:6443]: too many options (len: 32, packet len: 72): 0204ffd70402080a852ac5db00000000010303071f0c000012400000f7f96a83 <nil> 2023-08-01T14:44:30.377 failed to append twistlock options in host egress packet of [172.25.74.187:50212 -> 172.25.2.39:6443]: too many options (len: 32, packet len: 72): 020405a00402080a67932c5100000000010303071f0c0007e000000178de8835 <nil> 2023-08-01T14:44:30.385 failed to append twistlock options in host egress packet of [172.25.74.187:50218 -> 172.25.2.38:6443]: too many options (len: 32, packet len: 72): 020405a00402080a67932c5900000000010303071f0c0007e000000178de8835 <nil> 2023-08-01T14:44:30.639 failed to append twistlock options in host egress packet of [172.25.74.187:50234 -> 172.25.2.39:6443]: too many options (len: 32, packet len: 72): 020405a00402080a67932d5600000000010303071f0c0007e000000178de8835 <nil>]

 

Any idea?

 

Best

 

1 accepted solution

Accepted Solutions

L1 Bithead

Hi Humberto,

 

I hope you're doing well.  Based on the error message, it seems that the options length is too long to be appended to the host egress packet, and it's resulting in errors. This seems to be expected behavior if you enable network monitoring feature, it essentially enable partial feature of CNNF( now CNNS)

 Typically, when the iptables receives a header longer than 32 it will drop the connection, essentially killing that from ever reestablishing

 

The proper protocol and my recommendation is to open a support ticket and be sure to provide the Defender support information

  1. What defender version are you running?
  2. What type of defender is it
  3. The full defender log...

If possible, also include with the ticket the iptables rules programed at the host with and without CNNS

 

Thank you,

View solution in original post

1 REPLY 1

L1 Bithead

Hi Humberto,

 

I hope you're doing well.  Based on the error message, it seems that the options length is too long to be appended to the host egress packet, and it's resulting in errors. This seems to be expected behavior if you enable network monitoring feature, it essentially enable partial feature of CNNF( now CNNS)

 Typically, when the iptables receives a header longer than 32 it will drop the connection, essentially killing that from ever reestablishing

 

The proper protocol and my recommendation is to open a support ticket and be sure to provide the Defender support information

  1. What defender version are you running?
  2. What type of defender is it
  3. The full defender log...

If possible, also include with the ticket the iptables rules programed at the host with and without CNNS

 

Thank you,

  • 1 accepted solution
  • 1318 Views
  • 1 replies
  • 0 Likes
  • 46 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!