Bug ID 750278: A sub-second timeout for the SSL alert-timeout option may be desirable in certain cases

Last Modified: Jul 12, 2023

Affected Product(s):
BIG-IP LTM(all modules)

Known Affected Versions:
13.1.0,,,,,,,,, 13.1.1,,,,, 13.1.3,,,,,,, 13.1.4,, 13.1.5,, 14.0.0,,,,,, 14.0.1,, 14.1.0,,,,,, 14.1.2,,,,,,,,, 14.1.3, 15.0.0, 15.0.1,,

Fixed In:

Opened: Nov 16, 2018

Severity: 3-Major

Related Article: K25165813


For certain high-throughput applications running over SSL (for instance, video streaming), it may be desirable for the BIG-IP system to reset both flows as soon as possible once one side has sent a FIN but the peer side is continuing to send data. This situation can be undesirable (as it is wastes bandwidth) given that at this point the BIG-IP system is no longer proxying data but just dropping all remaining ingress packets (as SSL does not support half-closed TCP connections).


Even if the SSL alert-timeout option was set to its lowest allowed value (1 second), given a large number of connections in this specific state, the wasted bandwidth can reach considerable levels.


This issue occurs when the following conditions are met: - A standard virtual server with the client SSL and server SSL profiles in use. - As part of a connection handled by the virtual server, one side sends a FIN midstream to the BIG-IP system. - The peer side ignores the FIN and continues to send data.



Fix Information

The SSL alert-timeout option now supports the 'Immediate' value, which makes the BIG-IP system reset both flows after 1/1000 second.

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips