Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
lullejd
Contributor

fwpslglue_newconn: trying to initialize connection out of state

Hi All,

Did anyone ever encounter such messages in /var/log/messages?

Jan 21 17:36:31 2021 Gateway1 kernel: [fw4_2];fwpslglue_newconn: trying to initialize connection out of state, app 9[ASPII_MT], conn dir 0, 192.168.135.19:3575 -> 10.150.2.171:80 IPP 6, th_flags 11
Jan 21 17:36:31 2021 Gateway1 kernel: [fw4_1];fwpslglue_newconn: trying to initialize connection out of state, app 9[ASPII_MT], conn dir 0, 192.168.135.19:65016 -> 10.150.2.171:80 IPP 6, th_flags 11
Jan 21 17:36:31 2021 Gateway1 kernel: [fw4_0];fwpslglue_newconn: trying to initialize connection out of state, app 9[ASPII_MT], conn dir 0, 192.168.135.19:33397 -> 10.150.2.171:80 IPP 6, th_flags 11
Jan 21 17:36:31 2021 Gateway1 kernel: [fw4_1];fwpslglue_newconn: trying to initialize connection out of state, app 9[ASPII_MT], conn dir 0, 192.168.135.19:28698 -> 10.150.2.171:80 IPP 6, th_flags 11
Jan 21 17:36:31 2021 Gateway1 kernel: [fw4_0];fwpslglue_newconn: trying to initialize connection out of state, app 9[ASPII_MT], conn dir 0, 192.168.135.19:28173 -> 10.150.2.171:80 IPP 6, th_flags 11
Jan 21 17:36:31 2021 Gateway1 kernel: [fw4_1];fwpslglue_newconn: trying to initialize connection out of state, app 9[ASPII_MT], conn dir 0, 192.168.135.19:32099 -> 10.150.2.171:80 IPP 6, th_flags 11
Jan 21 17:36:31 2021 Gateway1 kernel: [fw4_0];fwpslglue_newconn: trying to initialize connection out of state, app 9[ASPII_MT], conn dir 0, 192.168.135.19:14247 -> 10.150.2.171:80 IPP 6, th_flags 11

Rulebase is using inline layers with no ordered layers.

I am trying to search in support center but I cannot find anything related. All of these logs are on port 80. It includes different IP addresses from internal to internal and from internal to external. It could be that such logs are generating high CPU. 

 

Thanks

 

Senior Information Security Engineer
0 Kudos
1 Reply
PhoneBoy
Admin
Admin

Are you also seeing "Out of State" drops in SmartView as well?
These are expected messages when we receive packets on potential connections that don't exist in the state tables.
If you believe these logs are excessive and causing high CPU, I recommend a TAC case.

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events