Model :

Hardware Version : Not Clear

Firmware Version :

ISP :

Packet that Is logged both In the ER5120 log view and In my syslog server is shown below:

<12>Jun 22 16:06:25 TL-ER5120[Warning]:2016-06-22 16:06:24 <4> : Detected ip packets with option field, dropped 50 packets.

The useful information in this message approaches zero. IP addresses? Ports?? Which option fields???

Is there any way of increasing the level of detail to the point that this can be of some use?

cheers,
Andrew

Model :

Hardware Version : Not Clear

Firmware Version :

ISP :

As part of my response to lack of information in the IP options logging (see previous post, cannot link to it) in Attack Defense settings I turned this off.

This action was not logged.

This is not acceptable in a 'Business' class product.

What configuration items allow me to correct this?

cheers
Andrew

Hi Acommons, I think the TP-LINK Router has no such detailed log information as you described. And as for " Detected ip packets with option field, dropped 50 packets", I think this is not a serious problem. Option field is one of the TCP fields, such option 82, so there is no need to enable this firewall.

Hi Alam,

Thanks for responding. Lack of logging makes this a Consumer rather than a Business device, absolutely no use in any security aware context. Pity.

In terms of option bits I suggest you have a look at this: https://tools.ietf.org/html/draft-ietf-tcpm-tcp-security-03

cheers,
Andrew