Message size XXX from xxx.xxx.xxx.xxx exceeds the maximum size

[Netbulae]

We have a custom zabbix_sender that sends some database statistics through an IPSEC VPN to our zabbix server.

The data doesn't get accepted and I see loads of these messages in the log:

Message size 7309943056852058316 from xxx.xxx.xxx.xxx exceeds the maximum size 67108864 bytes. Message ignored

When i sniff the traffic with tcpdump and send the exact same data directly using netcat (nc) on the port, it gets accepted perfectly.

After searching a lot I read some info about MTU issues that can cause these issues.

So I lowered the MTU to 1472 and forced MSS clamping:


http://lartc.org/howto/lartc.cookbook.mtu-mss.html

But I still get the errors. Any tips?

Kind regards,

Jorick Astrego
Netbulae B.V.

http://www.netbulae.eu

[Netbulae]

tcpdump output

Hmm, I see a difference in the tcpdump flags:

manual with NC:

12:30:45.931959 IP (tos 0x0, ttl 55, id 53686, offset 0, flags [none], proto TCP (6), length 240)
xxx.xxx.xxx.xxx.4120 > yyy.yyy.yyy.yyy.zabbix-trapper: Flags [P.], cksum 0xd8b1 (correct), seq 1:189, ack 1, win 229, options [nop,nop,TS val 88255264 ecr 5066332], length 188
E.......7..=....
.d{..'C...E...............
.B. .MN\{"request":"agent data","data":[{"host":"testing","key":"queue.messages.Count.auth entication-response-1.transform.singlepart.in","value":"0","clock":139 0299607534}],"clock":1390299842221}

zabbix_sender:

12:34:15.298760 IP (tos 0x0, ttl 61, id 10444, offset 0, flags [none], proto TCP (6), length 242)
yyy.yyy.yyy.yyy.52884 > yyyy.yyy.yyy.yyy.zabbix-trapper: Flags [FP.], cksum 0xce29 (correct), seq 10:200, ack 1, win 115, options [nop,nop,TS val 3714397606 ecr 5289557], length 190
E...(...=.......
.d{..'Cof.h.......s.).....
.e5..P.U{"request":"agent data","data":[{"host":"testing","key":"queue.messages.Count.auth entication-response-1.transform.singlepart.in","value":"0","clock":139 0303267515}],"clock":1390304055302}


I also see a response going out from the server to the sender when I try manually, but I don't have any code in the sender that does anything with the response. Could this be the problem?

[Netbulae]

Solved!

Fixed it, it appears the developer didn't include the zabbix header as in the java example:

https://www.zabbix.org/wiki/Docs/protocols/zabbix_sender/1.8/java_example

out.write(new byte[] {
'Z', 'B', 'X', 'D',
'\1',
(byte)(length & 0xFF),
(byte)((length >> 8) & 0x00FF),
(byte)((length >> 16) & 0x0000FF),
(byte)((length >> 24) & 0x000000FF),
'\0','\0','\0','\0'});