Last Modified: Oct 16, 2026
Affected Product(s):
BIG-IP All
Fixed In:
21.1.0.3, 17.5.1.10, 17.1.3.6
Opened: Jun 26, 2026 Severity: 3-Major
When the Flood attack vector is configured for the "suspicious" packet type, sending packets such as "TCP Option Overruns TCP Header," "TCP Option Present with Illegal Length," or "Unknown TCP Option Type" to the BIG-IP system should result in an increase in both the Flood attack statistics and drop counters. However, this is not occurring. The same issue also applies to the Sweep attack vector
The Flood attack vector statistics are not increasing as expected
Single Endpoint Flood/Sweep vector is configured with specific detection and mitigation thresholds, and "TCP Option Overruns TCP Header" packets are sent to the system
None
For most packet types, except for "bad packets," enforcement is typically delayed until a flow is established. Once the flow is active, enforcement is applied. However, for the three specific vector types mentioned, the flow already exists when the packet is processed, so enforcement is applied immediately within this flow rate path