Cisco Support Community
Community Member

incorrect exceeded connection limit

On a dmz interface I defined the connection-max to 10'000 connections.

Some time after, I get console error messages saying "exceeded connection limit"

and traffic is being blocked.

But a "show conn count" shows only 1'200 connections.

Any suggestions what's wrong here. We use 7.0(4)


Re: incorrect exceeded connection limit


the connections which you have specified as 10K, they are embryonic connections means half-open connections.

emb_limit : Specifies the maximum number of embryonic connections per host. The default is 0, which means unlimited embryonic connections.

Limiting the number of embryonic connections protects you from a DoS attack. The security appliance uses the embryonic limit to trigger TCP Intercept, which protects inside systems from a DoS attack perpetrated by flooding an interface with TCP SYN packets. An embryonic connection is a connection request that has not finished the necessary handshake between source and destination.

kindly update incase of any further doubt.


aashish C

Community Member

Re: incorrect exceeded connection limit

Hi aashish

thanks for your reply. I'm not quite sure if I got it right. The reason I wanted to restrict the connections was an event, where a Linux server from the DMZ generated UDP packets toward the internet like hell. We saw a connection count of 280'000. The server generated roughly 30'000 UDP packets per second, each 1 byte long. Embryonic connections deal with TCP SYN handshake, which is not used with UDP.

Therefore I need a way to restrict any kind of connection exceedng a certain count. My original question was, why the gell do I see just 1200 connections in use, and at the same time the firewall tells me "exceeded connection limit" under normal working conditions.

Cheers, Peter

CreatePlease to create content