VMG1312-B10A router: Unusual log messages

cnwoods

Within the last few days a new message has appeared in the logs:

kernel: xt_TCPMSS: bad length (129 bytes)

I haven't noticed any performance or other issues with the router. The message appears a few times a day. Is this something I should be concerned about?  I'm running the latest firmware. 

Thanks in advance.


#SP_Jun_2019

Hikari

Hi cnwoods

Do you have more history log in hands? I want to know there has more event before or after the log message, it may be more clear to find more info. 

cnwoods

I've set things up (under Maintenance -> Log Setting) to log to a local file (i.e the router) and to a  remote syslog server.  Curiously, the messages in question appear only on the syslog machine, often grouped together.  Their appearance seems quite arbitrary.  Here's a typical extract from the log:

Jun 13 07:49:13 syslog: category:"DHCP_server" detail:"Send DHCP ACK to 00:26:C6:48:E7:0E with IP 192.168.1.20"
Jun 13 14:42:40 syslog: category:"DHCP_server" detail:"Send DHCP ACK to 30:E1:71:18:5E:B6 with IP 192.168.1.15"
Jun 13 14:51:22 kernel: xt_TCPMSS: bad length (129 bytes)
Jun 13 15:04:40 kernel: xt_TCPMSS: bad length (129 bytes)
Jun 13 15:06:51 kernel: xt_TCPMSS: bad length (130 bytes)
Jun 13 15:43:00 syslog: category:"DHCP_server" detail:"Receive DHCP REQUEST from "
Jun 13 15:43:00 syslog: category:"DHCP_server" detail:"Send DHCP ACK to AC:57:75:14:C5:F3 with IP 192.168.1.27"
Jun 13 15:56:22 kernel: xt_TCPMSS: bad length (129 bytes)
Jun 13 17:59:41 syslog: category:"DHCP_server" detail:"Receive DHCP REQUEST from "
Jun 13 17:59:41 syslog: category:"DHCP_server" detail:"Send DHCP ACK to 00:22:43:25:D8:CF with IP 192.168.1.17"

I've done a google search of the log message, and the results are mostly from Netgear and Cisco routers.  Presumably, they use the same bits of Linux code in their firmware. 

Any hints much appreciated.

Mijzelf

No need to worry. It just means the system got some malformed IP packet, where the received number of bytes do not match the header, and it's simply dropped. You can find the code generating this message here.

Curiously, the messages in question appear only on the syslog machine,

That's already a reference that's it's not important. The internal logging has dropped it.

often grouped together. 

I guess you had a connection which went through some lesser reliably line.

cnwoods

Thanks very much Mijzelf.

I guess you had a connection which went through some lesser reliably line.

Interesting. I shall check my cabling.

Cheers.

Mijzelf

It's not your cabling. In that case you'd see more messages. But if you see them in small groups, I think you (or actually your browser) was getting some resource from a distant server, which caused some malformed packets.