Bug ID 683135: Hardware syncookies number for virtual server stats is unrealistically high

Last Modified: Oct 16, 2023

Affected Product(s):
BIG-IP LTM(all modules)

Known Affected Versions:
12.1.2, 12.1.3,,,,,,,, 12.1.4,, 12.1.5,,,, 12.1.6, 13.0.0, 13.0.0 HF1, 13.0.0 HF2, 13.0.0 HF3, 13.0.1, 13.1.0,,,,,,,,, 13.1.1,,,,, 13.1.3,, 14.0.0,,,,,, 14.0.1,, 14.1.0,,,,,, 14.1.2,,,,,,, 15.0.0, 15.0.1,,,,

Fixed In:

Opened: Sep 12, 2017

Severity: 3-Major


In some situations 'tmsh show ltm virtual' shows unrealistically high hardware (HW) syncookie numbers. These unrealistically high HW syncookie stats cause AFM DoS TCP synflood vector to have high numbers, and that can cause TCP synflood vector to drop packets in HW based on the configured rate-limit for that vector.


Stats issue. Can have impact to traffic if AFM TCP Synflood vector is enabled in mitigation mode.


Virtual server with hardware syncookie protection enabled.


Disable the TCP Synflood vector in mitigate mode. Since Syncookie is already providing protection, the TCP Synflood option should be enabled only in detect-only mode, if at all.

Fix Information


Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips