Bug ID 883089: Excessive TMM memory consumption by "Anti-Replay" protection for TLS 1.3 0-RTT/Early Data

Last Modified: Jan 20, 2023

Bug Tracker

Affected Product:  See more info
BIG-IP LTM(all modules)

Known Affected Versions:
15.1.0,,,,,, 15.1.1, 15.1.2,, 15.1.3,, 15.1.4,, 15.1.5,, 15.1.6,, 15.1.7, 15.1.8,, 16.0.0,, 16.0.1,,, 16.1.0, 16.1.1, 16.1.2,,, 16.1.3,,,

Opened: Feb 20, 2020
Severity: 2-Critical


Incoming packets are dropped, connections are dropped. "Aggressive mode sweeper" messages recorded in "ltm" log, such as: warning tmm[457]: 011e0003:3: Aggressive mode sweeper: /Common/default-eviction-policy (1cf1) (global memory) 99 Connections killed The output of the following command shows a value of 2.3G for "Alloc (bytes)": # tmsh show sys memory | grep -E "SubSystem|EB.Tree"


Dropping packets and connections impedes handling of network traffic. In extreme cases, the shortage of available TMM memory may trigger a greater disruption.


-- At least one virtual server has a clientssl profile configured to enable the TLS 1.3 protocol, along with the advanced option setting "0-RTT/Early Data with Anti-Replay". (In the Configuration Utility, the field in Profile Properties is "Data 0-RTT" and the value would be "Enabled with Anti-Replay".)


In the "clientssl" profile, set the TLS 1.3 option "Data 0-RTT" to "Disabled".

Fix Information


Behavior Change