I am getting the following message about once every 30 seconds:
09-18-2007 14:12:03 Syslog.Warning 10.2.3.254 145322: Sep 18 19:12:39.339: %FW-4-TCP_OoO_SEG: Dropping TCP Segment: seq:357141655 1500 bytes is out-of-order; expected seq:357116835. Reason: TCP reassembly queue overflow - session 10.1.4.4:52255 to 126.96.36.199:80
It is always from a different source and to a different destination.
Googling that error provided only one reply, and that was to a Chinese website.
What does TCP reassembly queue overflow mean? I am assuming it is referring to resequencing out of sequence TCP packets. Do you all see this too on your Internet-facing routers? And how do I stop it from filling up my syslogs?
CPU usage is at ~10%, so it is not a CPU problem. The router is a 2821. The connection that is reporting the drops is a multilink PPP with two T1s in it. Here is a display from the past month of a "show int multi 1"
Input queue: 1/75/359/0 (size/max/drops/flushes)
I am using fifo, not any sort of special queuing on this port.