tcp packets out of order

network770 · ‎09-23-2011

we are getting a lot of such messages on our cisco881 router, we have firewall and ips services running on it... why are the packets coming out of order and is this alarming?

*Sep 23 14:50:24.600: %FW-4-TCP_OoO_SEG: Dropping TCP Segment: seq:335347389 1300 bytes is out-of-order; expected seq:335323449. Reason: TCP reassembly queue overflow - session 192.168.14.13:4899 to 167.206.252.16:80

*Sep 23 14:50:26.876: %FW-4-TCP_OoO_SEG: Dropping TCP Segment: seq:335996289 1300 bytes is out-of-order; expected seq:335973609. Reason: TCP reassembly queue overflow - session 192.168.14.13:4899 to 167.206.252.16:80

*Sep 23 14:54:44.220: %FW-4-TCP_OoO_SEG: Dropping TCP Segment: seq:3688595027 1290 bytes is out-of-order; expected seq:3688555027. Reason: TCP reassembly queue overflow - session 192.168.14.13:1049 to 10.229.151.190:80

*Sep 23 14:57:38.752: %FW-4-TCP_OoO_SEG: Dropping TCP Segment: seq:4051368463 1470 bytes is out-of-order; expected seq:4051344181. Reason: TCP reassembly queue overflow - session 192.168.14.11:3733 to 74.125.226.133:80

*Sep 23 14:58:02.176: %FW-4-TCP_OoO_SEG: Dropping TCP Segment: seq:2917423946 1492 bytes is out-of-order; expected seq:2917389098. Reason: TCP reassembly queue overflow - session 192.168.14.11:3887 to 67.212.231.238:80

Jennifer Halim · ‎09-24-2011

There might be multiple different routes to get to a network, and each packet does not follow the same route, hence packet can be out of order.

TCP out of order is pretty normal and not alarming unless it causes huge latency issue. Sometimes a device buffer is not enough to buffered the whole TCP stream and also it can take up more CPU to order those out of order TCP packet depending on how large the TCP stream is. Generally, it should be OK however, it could be a sign of possible latency or some devices buffer might not be large enough to reorder the TCP steam.