Excessive Number Of Kernel: BadFlags Messages Seen

Products

• CA API Gateway

Issue/Introduction

We are seeing an excessive number of the following kinds of messages within our /var/log/messages file:

HostName kernel: Badflags:IN=ssg_eth0 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=xx.xx.xx.xx DST=xx.xx.xx.xx LEN=84 TOS=0x00 PREC=0x00 TTL=52 ID=7902 DF PROTO=ICMP TYPE=8 CODE=0 ID=691 SEQ=55257

Environment

Gateway 10.x

Cause

This was do to a firewall rule implemented within the environment, looking at the iptables file we could see the following in place:

badflags   icmp --  0.0.0.0/0            0.0.0.0/0 

Resolution

Determine why the source ip address listed in the message is constantly sending an icmp request to the destination address.  We could also remove the firewall rule in question if it is not needed or modify it to better meet the needs of the environment.