IPTables Logging a Flood of "TCP INCOMPLETE" Messages

Question

Currently trying to investigate what appears to be load-related problems with a web server and I've found a flood of logs from IPTables that I don't recognize. They all look like this:

Feb 26 12:03:52 dop002 warning [2559556.039033] IN=eth1 OUT= MAC=snip SRC=88.115.48.62 DST=snip LEN=56 TOS=0x00 PREC=0x00 TTL=54 ID=14166 PROTO=ICMP TYPE=5 CODE=1 GATEWAY=88.115.48.1 [SRC=snip DST=88.115.60.143 LEN=40 TOS=0x00 PREC=0x00 TTL=57 ID=42868 DF PROTO=TCP INCOMPLETE [8 bytes] ]

Can anyone tell me what this log line means? There's a ton of them in /var/log/messages.

Thanks.

Answer 1

This is an ICMP Type 5 message.

RFC 792

Description

 The gateway sends a redirect message to a host in the following
 situation.  A gateway, G1, receives an internet datagram from a
 host on a network to which the gateway is attached.  The gateway,
 G1, checks its routing table and obtains the address of the next
 gateway, G2, on the route to the datagram's internet destination
 network, X.  If G2 and the host identified by the internet source
 address of the datagram are on the same network, a redirect
 message is sent to the host.  The redirect message advises the
 host to send its traffic for network X directly to gateway G2 as
 this is a shorter path to the destination.  The gateway forwards
 the original datagram's data to its internet destination.

 For datagrams with the IP source route options and the gateway
 address in the destination address field, a redirect message is
 not sent even if there is a better route to the ultimate
 destination than the next address in the source route.

 Codes 0, 1, 2, and 3 may be received from a gateway.