# Keep getting: Connection attempt from node 'AAAAAA@AAAAAAA' rejected since it cannot handle \["BIG\_CREATION"\] **URL:** \ **Category:** Questions / Help\ **Tags:** cowboy\ **Created:** [April 18, 2023, 4:15am UTC](https://erlangforums.com/t/keep-getting-connection-attempt-from-node-aaaaaa-aaaaaaa-rejected-since-it-cannot-handle-big-creation/2544 "2023-04-18T04:15:54Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![leeyis](https://erlangforums.com/user_avatar/erlangforums.com/leeyis/32/1191_2.png) [@leeyis](https://erlangforums.com/u/leeyis)\ **Post date:** [April 18, 2023, 4:15am UTC](https://erlangforums.com/t/keep-getting-connection-attempt-from-node-aaaaaa-aaaaaaa-rejected-since-it-cannot-handle-big-creation/2544/1 "2023-04-18T04:15:54Z")
In my [open source project](https://github.com/imboy-pub/imboy) , I receive such errors all the time. I don’t know why I receive similar errors. How can I solve the problem? error.log: ```erlang 2023-04-17 20:03:12.420 UTC [error] <0.2886.6> **'imboy@127.0.0.1': Connection attempt from node 'AAAAAA@AAAAAAA' rejected since it cannot handle ["BIG_CREATION"].** ``` ---
**Author:** ![mmin](https://erlangforums.com/user_avatar/erlangforums.com/mmin/32/2193_2.png) [@mmin](https://erlangforums.com/u/mmin)\ **Post date:** [April 18, 2023, 9:51am UTC](https://erlangforums.com/t/keep-getting-connection-attempt-from-node-aaaaaa-aaaaaaa-rejected-since-it-cannot-handle-big-creation/2544/2 "2023-04-18T09:51:57Z")
Distribution flag **DFLAG\_BIG\_CREATION** became mandatory from OTP23. It says: `This flag is mandatory. If not present, the connection is refused`. You’re probably connecting node running OTP\<23 and node running OTP\>=23. ---
**Author:** ![leeyis](https://erlangforums.com/user_avatar/erlangforums.com/leeyis/32/1191_2.png) [@leeyis](https://erlangforums.com/u/leeyis)\ **Post date:** [April 18, 2023, 12:14pm UTC](https://erlangforums.com/t/keep-getting-connection-attempt-from-node-aaaaaa-aaaaaaa-rejected-since-it-cannot-handle-big-creation/2544/3 "2023-04-18T12:14:51Z")
I did not initiate the connection myself, I guess it is malicious attack, I am not sure, no evidence, how to prevent similar errors?, My environment is: erl --version Erlang/OTP 24 [erts-12.3.1] [source] [64-bit] [smp:2:2] [ds:2:2:10] [async-threads:1] [jit] Eshell V12.3.1 (abort with ^G) > [@leeyis](#): > > `'` ---
**Author:** ![mmin](https://erlangforums.com/user_avatar/erlangforums.com/mmin/32/2193_2.png) [@mmin](https://erlangforums.com/u/mmin)\ **Post date:** [April 18, 2023, 12:46pm UTC](https://erlangforums.com/t/keep-getting-connection-attempt-from-node-aaaaaa-aaaaaaa-rejected-since-it-cannot-handle-big-creation/2544/4 "2023-04-18T12:46:32Z")
Hmm, did you set cookie for your VM at startup (via -setcookie flag)? After this, you could set [TLS for Erlang Distribution](https://www.erlang.org/docs/22/apps/ssl/ssl_distribution.html). By using those two methods you’ll reject all connection attempts that don’t have matching cookie and aren’t using TLS. However, you’ll still get error logs. Next step could be Firewall to block connection attempts from the attacker. ---
**Author:** ![leeyis](https://erlangforums.com/user_avatar/erlangforums.com/leeyis/32/1191_2.png) [@leeyis](https://erlangforums.com/u/leeyis)\ **Post date:** [April 18, 2023, 1:26pm UTC](https://erlangforums.com/t/keep-getting-connection-attempt-from-node-aaaaaa-aaaaaaa-rejected-since-it-cannot-handle-big-creation/2544/5 "2023-04-18T13:26:15Z")
I set the cookie; How to set up the firewall? Can you give some reference? ---
**Author:** ![mmin](https://erlangforums.com/user_avatar/erlangforums.com/mmin/32/2193_2.png) [@mmin](https://erlangforums.com/u/mmin)\ **Post date:** [April 18, 2023, 2:13pm UTC](https://erlangforums.com/t/keep-getting-connection-attempt-from-node-aaaaaa-aaaaaaa-rejected-since-it-cannot-handle-big-creation/2544/6 "2023-04-18T14:13:30Z")
Firewall is completely separated from Erlang node. You can set it network-wise on your router or [on your PC via iptables](https://upcloud.com/resources/tutorials/configure-iptables-ubuntu). E.g. you could drop packages from attacker’s IP address or you could drop all non-TLS connections to port where your node is exposed. There are lots of tutorials on web. ---
**Author:** ![starbelly](https://erlangforums.com/user_avatar/erlangforums.com/starbelly/32/209_2.png) [@starbelly](https://erlangforums.com/u/starbelly)\ **Post date:** [April 19, 2023, 2:00am UTC](https://erlangforums.com/t/keep-getting-connection-attempt-from-node-aaaaaa-aaaaaaa-rejected-since-it-cannot-handle-big-creation/2544/7 "2023-04-19T02:00:25Z")
FWIW, that’s definitely an attack. There’s a copy / paste exploit from 2020 that matches the pattern `AAAAAA@AAAAAAA`. Please take @mmin’s advice and secure your network and nodes. Especially heeding to using TLS and a firewall, cookies are not really an authentication mechanism. Rather, and IMHO they are a way to wall off nodes (or entire clusters) from one or another. That is not to say you shouldn’t have a good unpredictable cookie though! See [Erlang -- Distributed Erlang](https://www.erlang.org/doc/reference_manual/distributed.html) for more information on tls and and cookies.