CUCM - RTMT System Log Message SYN Flooding, Port 2000

[melinda.clancy]

I have CUCM 10.5.  I monitor the RTMT for errors. In RTMT System log, I see "possible SYN flooding on port 2000.  Sending cookies."  This is only happening on two of my Subscribers.  It is not happening on the other two Subscribers or the Publisher.

I have attempted to find the answer to why this is happening, but I cannot find anything for SYN flooding on port 2000. Sending cookies.

If anyone has an answer to this, please let me know.

Thanks,

Melinda

[Manish Gogna · Accepted solution]

Hi Melinda,

This could be either a network connectivity or a performance issue on these subs. You may get the outputs of the following to see if there is any core dump or error that shows up on these subs

show status

utils core active list

utils diagnose test

Check for any SDL OOS or CPU/Mem pegging alerts as well.

Manish

[melinda.clancy]

This appears to be the correct answer as we had a fiber issue (fiber ring).  I talked to the network guy and he is not sure why this might be happening.  But as soon as the fiber was fixed, the SYN flooding stopped.  I also had an issue with the PUB and Subs hitting the NTP server.

I truly appreciate the responses, as it gave me trouble shooting information.

Thanks to both for your knowledge.

Melinda

[Aseem Anand]

Check if there are any cluster authentication errors using the output of the command "Show network cluster".

Also check event viewer application and system logs to see if there are any transient connection attempts from IP phones on port 2000. You may setup captures on CUCM using the link below on port 2000 to see from which devices are you getting these requests:

https://supportforums.cisco.com/document/44376/packet-capture-cucm-appliance-model

Please make sure:

1 . You are not using VMWare snapshots as they tend to affect CPU performance.

2.  If you have a VG224 or VG320 etc, make sure you shutdown any unused ports as they tend to send out repeated registration requests.

Aseem