## RX-OVR drops and 10 gb hardware buffer

Customer's rx drops equals their rx overrides.  They are having issues with too many drops, which manifests on policy install as the adjacent switches see the link going down.  They have 2 1gb interfaces bonded on internal and external.  Regarding rx-ovr drops, according to SK33781:

the number of times the receiver hardware was unable to hand received data to a hardware buffer - the internal FIFO buffer of the chip is full, but is still tries to handle incoming traffic ; most likely, the input rate of traffic exceeded the ability of the receiver to handle the data.

Max Power says the best solution here is to bond more interfaces.  As they already have 2 bonded interfaces, we are considering 10 gb interfaces.  To my question then: does a 10 gb interface have a larger hardware buffer than 2 1 gb bonded interfaces?  And my follow up question:  do you have numbers on this?  These are 13800s with the onboard 1 gb and 10 gb interfaces.  This is a big customer and we are in a precarious position on this one and this answer may help decide how we proceed.  This is very time sensitive as well.  Thank you.

[1\\
\\
\\
Kudo](https://community.checkpoint.com/t5/kudos/messagepage/board-id/general-topics/message-id/4923/tab/all-users "Click here to see who gave kudos to this post.")

[Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/24666?t:ac=board-id/general-topics/thread-id/4923&t:cp=kudos/contributions/tapletcontributionspage&ticket=sE_1lFPNoyhU_-1 "Click here to give kudos to this post.")

1

2

3

4

5

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

[Reply](https://community.checkpoint.com/t5/General-Topics/RX-OVR-drops-and-10-gb-hardware-buffer/td-p/24666)

- [All forum topics](https://community.checkpoint.com/t5/General-Topics/bd-p/general-topics/page/435 "General Topics")
- [Previous Topic](https://community.checkpoint.com/t5/General-Topics/RDP-over-HTTPS-Inspection/td-p/25535 "RDP over HTTPS Inspection")
- [Next Topic](https://community.checkpoint.com/t5/General-Topics/High-CPU-after-upgrade-from-77-30-to-80-10/td-p/14334 "High CPU after upgrade from 77.30 to 80.10")

8 Replies

[JozkoMrkvicka](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/1702)

Authority

‎2018-09-0402:24 PM

[Show option menu](https://community.checkpoint.com/t5/General-Topics/RX-OVR-drops-and-10-gb-hardware-buffer/td-p/24666# "Show option menu")

- Mark as New
- Bookmark
- Subscribe
- Mute
- [Subscribe to RSS Feed](https://community.checkpoint.com/rss/message?board.id=general-topics&message.id=4924)
- [Permalink](https://community.checkpoint.com/t5/General-Topics/RX-OVR-drops-and-10-gb-hardware-buffer/m-p/24667/highlight/true#M4924)
- [Print](https://community.checkpoint.com/t5/forums/forumtopicprintpage/board-id/general-topics/message-id/4924/print-single-message/true/page/1)
- [Report Inappropriate Content](https://community.checkpoint.com/t5/notifications/notifymoderatorpage/message-uid/24667)

One option is to increase RX ring size buffer, BUT as was mentioned by Tim, this is not the solution.

Check this one:

[https://community.checkpoint.com/message/22354-re-increasing-fifo-buffers-on-firewall-interface](https://community.checkpoint.com/thread/8056-increasing-fifo-buffers-on-firewall-interface?commentID=22354#comment "https://community.checkpoint.com/message/22354-re-increasing-fifo-buffers-on-firewall-interface?commentID=22354#comment-22354")

cc [Timothy Hall](https://community.checkpoint.com/migrated-users/41625) ‌

Kind regards,

**Jozko** Mrkvicka

0

Kudos

[Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/24667?t:ac=board-id/general-topics/thread-id/4923&t:cp=kudos/contributions/tapletcontributionspage&ticket=sE_1lFPNoyhU_-1 "Click here to give kudos to this post.")

1

2

3

4

5

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

[Reply](https://community.checkpoint.com/t5/General-Topics/RX-OVR-drops-and-10-gb-hardware-buffer/td-p/24666)

[Timothy\_Hall](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/597)

MVP Gold

‎2018-09-0507:13 AM

[Show option menu](https://community.checkpoint.com/t5/General-Topics/RX-OVR-drops-and-10-gb-hardware-buffer/td-p/24666# "Show option menu")

- Mark as New
- Bookmark
- Subscribe
- Mute
- [Subscribe to RSS Feed](https://community.checkpoint.com/rss/message?board.id=general-topics&message.id=4925)
- [Permalink](https://community.checkpoint.com/t5/General-Topics/RX-OVR-drops-and-10-gb-hardware-buffer/m-p/24668/highlight/true#M4925)
- [Print](https://community.checkpoint.com/t5/forums/forumtopicprintpage/board-id/general-topics/message-id/4925/print-single-message/true/page/1)
- [Report Inappropriate Content](https://community.checkpoint.com/t5/notifications/notifymoderatorpage/message-uid/24668)

10Gbps interfaces definitely have a lot more NIC hardware buffer space and much more processing power to avoid overruns.  1Gbps interfaces tend to start running out of gas somewhere north of 900Mbps of throughput, especially if most frames are near the minimum size.  Increasing ring buffer sizes is a last resort and may get you into further trouble.

So a 10Gbps interface would certainly help, but before going down that road there are a few things that you should check:

1) Is the traffic being reasonably load balanced between the two 1Gbps bonded interfaces?  Please post the output of **netstat -ni** showing both physical interfaces that are part of the bond.  The RX-OK and TX-OK values should be roughly equivalent between the two interfaces.  If RX-OK is substantially higher on one interface vs. another, check your bond operation mode/hash policy & STP setup on the upstream switch; if TX-OK is substantially higher on one interface vs. another, check your bond operation mode/hash policy on the firewall itself via the Gaia web interface.

2) Some driver/NIC combinations increment RX-DRP and RX-OVR in lock-step, and it is not possible to conclusively determine what is going on with just the netstat command.  Please post the output of **ethtool -S (interface)** for the two physical interfaces, with this info it will be possible to see if there are overruns or drops/misses occurring on the interfaces.  The mitigation strategy for one vs. the other is quite different.

3) If the adjacent switches are truly losing link integrity that sounds like a physical issue, since no matter how bad RX-DRPs/RX-OVR's get it should never cause a loss of link integrity.  The ethtool output will show if there are actual carrier transitions occurring, it is also possible the switches are seeing the firewall NICs sending a flow control XOFF but that situation is quite different from actually losing carrier.

--

Second Edition of my "Max Power" Firewall Book

Now Available at[http://www.maxpowerfirewalls.com](http://www.maxpowerfirewalls.com/)

New Book: "Max Power 2026" Coming Soon

Check Point Firewall Performance Optimization

[1\\
\\
\\
Kudo](https://community.checkpoint.com/t5/kudos/messagepage/board-id/general-topics/message-id/4925/tab/all-users "Click here to see who gave kudos to this post.")

[Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/24668?t:ac=board-id/general-topics/thread-id/4923&t:cp=kudos/contributions/tapletcontributionspage&ticket=sE_1lFPNoyhU_-1 "Click here to give kudos to this post.")

1

2

3

4

5

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

[Reply](https://community.checkpoint.com/t5/General-Topics/RX-OVR-drops-and-10-gb-hardware-buffer/td-p/24666)

[Daniel\_Westlund](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/11671)

Collaborator

‎2018-09-0507:27 AM

[Show option menu](https://community.checkpoint.com/t5/General-Topics/RX-OVR-drops-and-10-gb-hardware-buffer/td-p/24666# "Show option menu")

- Mark as New
- Bookmark
- Subscribe
- Mute
- [Subscribe to RSS Feed](https://community.checkpoint.com/rss/message?board.id=general-topics&message.id=4926)
- [Permalink](https://community.checkpoint.com/t5/General-Topics/RX-OVR-drops-and-10-gb-hardware-buffer/m-p/24669/highlight/true#M4926)
- [Print](https://community.checkpoint.com/t5/forums/forumtopicprintpage/board-id/general-topics/message-id/4926/print-single-message/true/page/1)
- [Report Inappropriate Content](https://community.checkpoint.com/t5/notifications/notifymoderatorpage/message-uid/24669)

[In response to Timothy\_Hall](https://community.checkpoint.com/t5/General-Topics/RX-OVR-drops-and-10-gb-hardware-buffer/m-p/24668/highlight/true#M4925)

Thanks!  An SE is going on site today and we may get this info you asked about.  In the time since I posted this, I found a thread on CPUG for a similar issue to what we are seeing here, and so for the time being I'm running with your ideas from that thread, that the rx-ovr may just be regular drops in lock step as you say here, and that "Keep all connections" should reduce the load on policy push at the time we see connections drop and rx-drops and the link show as down from the switch.  The customer understands that is more of a fix for the symptom than the core issue.

0

Kudos

[Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/24669?t:ac=board-id/general-topics/thread-id/4923&t:cp=kudos/contributions/tapletcontributionspage&ticket=sE_1lFPNoyhU_-1 "Click here to give kudos to this post.")

1

2

3

4

5

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

[Reply](https://community.checkpoint.com/t5/General-Topics/RX-OVR-drops-and-10-gb-hardware-buffer/td-p/24666)

[Daniel\_Westlund](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/11671)

Collaborator

‎2018-09-0509:25 AM

[Show option menu](https://community.checkpoint.com/t5/General-Topics/RX-OVR-drops-and-10-gb-hardware-buffer/td-p/24666# "Show option menu")

- Mark as New
- Bookmark
- Subscribe
- Mute
- [Subscribe to RSS Feed](https://community.checkpoint.com/rss/message?board.id=general-topics&message.id=4927)
- [Permalink](https://community.checkpoint.com/t5/General-Topics/RX-OVR-drops-and-10-gb-hardware-buffer/m-p/24670/highlight/true#M4927)
- [Print](https://community.checkpoint.com/t5/forums/forumtopicprintpage/board-id/general-topics/message-id/4927/print-single-message/true/page/1)
- [Report Inappropriate Content](https://community.checkpoint.com/t5/notifications/notifymoderatorpage/message-uid/24670)

[In response to Timothy\_Hall](https://community.checkpoint.com/t5/General-Topics/RX-OVR-drops-and-10-gb-hardware-buffer/m-p/24668/highlight/true#M4925)

Below are netstat -ni and ethtool -S (interface) from one of the physical interfaces, and they all look similar.  I don't see override errors on the physical.  I do see in netstat -ni that TX-OK is about 3 times more for the first interface in the bond than the second.  They are running 802.3ad for the bond operational mode.  The ClusterXL Admin guide says "All the slave interfaces of a bond must be connected to the same switch. The switch itself must support and be configured for Link Aggregation, by the same standard (for example, 802.3ad, or XOR) as the Security Gateway bond."  I do not know that to be the case on the switch, but I can check.  Let me know your thoughts:

Kernel Interface table

Iface       MTU Met    RX-OK RX-ERR RX-DRP RX-OVR    TX-OK TX-ERR TX-DRP TX-OVR Flg

Mgmt       1500   0        0      0      0      0        0      0      0      0 BMU

Sync       1500   0 139761106      0   4769      0 483359145      0      0      0 BMRU

bond1      1500   0 5871992169      0  45491  45491 7323084565      0      0      0 BMmRU

bond1.5    1500   0 256770036      0      0      0 197671961      0      0      0 BMmRU

bond1.6    1500   0        7      0      0      0     7051      0      0      0 BMmRU

bond1.10   1500   0 5349158116      0      0      0 6813570243      0      0      0 BMmRU

bond1.162  1500   0  7998804      0      0      0  9863117      0      0      0 BMmRU

bond1.164  1500   0       94      0      0      0   302840      0      0      0 BMmRU

bond1.2096  1500   0  5913743      0      0      0  7977585      0      0      0 BMmRU

bond1.2128  1500   0 240366030      0      0      0 287076273      0      0      0 BMmRU

bond2      1500   0 8035743271      0 232231 232231 6498159149      0      0      0 BMmRU

bond2.2    1500   0 417512540      0      0      0 493632825      0      0      0 BMmRU

bond2.3    1500   0 6657176536      0      0      0 5183424132      0      0      0 BMmRU

bond2.4    1500   0 221669412      0      0      0 173697823      0      0      0 BMmRU

bond2.7    1500   0        7      0      0      0     7051      0      0      0 BMmRU

bond2.11   1500   0 715470330      0      0      0 639767094      0      0      0 BMmRU

bond2.12   1500   0       26      0      0      0    16350      0      0      0 BMmRU

bond2.69   1500   0   252108      0      0      0   204379      0      0      0 BMmRU

bond2.209  1500   0  4406029      0      0      0   753373      0      0      0 BMmRU

bond2.2231  1500   0   575132      0      0      0   176454      0      0      0 BMmRU

bond2.2232  1500   0        7      0      0      0     7051      0      0      0 BMmRU

bond2.2233  1500   0  3237699      0      0      0  3268497      0      0      0 BMmRU

eth1-05    1500   0 3207332404      0  15410  15410 **5565121913**      0      0      0 BMsRU

eth1-06    1500   0 2664661974      0  30081  30081 **1757965501**      0      0      0 BMsRU

eth1-07    1500   0 4295070957      0 130127 130127 **4859459422**      0      0      0 BMsRU

eth1-08    1500   0 3740674264      0 102104 102104 **1638701316**      0      0      0 BMsRU

lo        16436   0 14648647      0      0      0 14648647      0      0      0 LRU

NIC statistics:

rx\_packets: 3743909849

tx\_packets: 1640140201

rx\_bytes: 3340303812889

tx\_bytes: 695877051313

rx\_broadcast: 9467756

tx\_broadcast: 8181805

rx\_multicast: 506441

tx\_multicast: 14089

multicast: 506441

collisions: 0

rx\_crc\_errors: 0

rx\_no\_buffer\_count: 83

rx\_missed\_errors: 102104

tx\_aborted\_errors: 0

tx\_carrier\_errors: 0

tx\_window\_errors: 0

tx\_abort\_late\_coll: 0

tx\_deferred\_ok: 0

tx\_single\_coll\_ok: 0

tx\_multi\_coll\_ok: 0

tx\_timeout\_count: 0

rx\_long\_length\_errors: 0

rx\_short\_length\_errors: 0

rx\_align\_errors: 0

tx\_tcp\_seg\_good: 0

tx\_tcp\_seg\_failed: 0

rx\_flow\_control\_xon: 0

rx\_flow\_control\_xoff: 0

tx\_flow\_control\_xon: 0

tx\_flow\_control\_xoff: 0

rx\_long\_byte\_count: 3340303812889

tx\_dma\_out\_of\_sync: 0

lro\_aggregated: 0

lro\_flushed: 0

lro\_recycled: 0

tx\_smbus: 0

rx\_smbus: 0

dropped\_smbus: 0

os2bmc\_rx\_by\_bmc: 0

os2bmc\_tx\_by\_bmc: 0

os2bmc\_tx\_by\_host: 0

os2bmc\_rx\_by\_host: 0

rx\_errors: 0

tx\_errors: 0

tx\_dropped: 0

rx\_length\_errors: 0

rx\_over\_errors: 0

rx\_frame\_errors: 0

rx\_fifo\_errors: 102104

tx\_fifo\_errors: 0

tx\_heartbeat\_errors: 0

tx\_queue\_0\_packets: 196959828

tx\_queue\_0\_bytes: 83040941180

tx\_queue\_0\_restart: 0

tx\_queue\_1\_packets: 201112750

tx\_queue\_1\_bytes: 92708792933

tx\_queue\_1\_restart: 1

tx\_queue\_2\_packets: 213423707

tx\_queue\_2\_bytes: 86340004477

tx\_queue\_2\_restart: 1

tx\_queue\_3\_packets: 216066507

tx\_queue\_3\_bytes: 83047793486

tx\_queue\_3\_restart: 1

tx\_queue\_4\_packets: 204186677

tx\_queue\_4\_bytes: 73263555527

tx\_queue\_4\_restart: 0

tx\_queue\_5\_packets: 204344731

tx\_queue\_5\_bytes: 92081661081

tx\_queue\_5\_restart: 2

tx\_queue\_6\_packets: 213009461

tx\_queue\_6\_bytes: 93208852639

tx\_queue\_6\_restart: 1

tx\_queue\_7\_packets: 191036540

tx\_queue\_7\_bytes: 77855042012

tx\_queue\_7\_restart: 0

rx\_queue\_0\_packets: 453259566

rx\_queue\_0\_bytes: 409861555187

rx\_queue\_0\_drops: 0

rx\_queue\_0\_csum\_err: 835

rx\_queue\_0\_alloc\_failed: 0

rx\_queue\_1\_packets: 489210382

rx\_queue\_1\_bytes: 429176166020

rx\_queue\_1\_drops: 0

rx\_queue\_1\_csum\_err: 782

rx\_queue\_1\_alloc\_failed: 0

rx\_queue\_2\_packets: 525554274

rx\_queue\_2\_bytes: 416704083839

rx\_queue\_2\_drops: 0

rx\_queue\_2\_csum\_err: 1347

rx\_queue\_2\_alloc\_failed: 0

rx\_queue\_3\_packets: 477789928

rx\_queue\_3\_bytes: 449291458631

rx\_queue\_3\_drops: 0

rx\_queue\_3\_csum\_err: 1047

rx\_queue\_3\_alloc\_failed: 0

rx\_queue\_4\_packets: 464353091

rx\_queue\_4\_bytes: 423139957349

rx\_queue\_4\_drops: 0

rx\_queue\_4\_csum\_err: 1394

rx\_queue\_4\_alloc\_failed: 0

rx\_queue\_5\_packets: 455349424

rx\_queue\_5\_bytes: 390616991572

rx\_queue\_5\_drops: 0

rx\_queue\_5\_csum\_err: 1065

rx\_queue\_5\_alloc\_failed: 0

rx\_queue\_6\_packets: 428981359

rx\_queue\_6\_bytes: 384441256460

rx\_queue\_6\_drops: 0

rx\_queue\_6\_csum\_err: 493

rx\_queue\_6\_alloc\_failed: 0

rx\_queue\_7\_packets: 449411832

rx\_queue\_7\_bytes: 407122763165

rx\_queue\_7\_drops: 0

rx\_queue\_7\_csum\_err: 1075

rx\_queue\_7\_alloc\_failed: 0

0

Kudos

[Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/24670?t:ac=board-id/general-topics/thread-id/4923&t:cp=kudos/contributions/tapletcontributionspage&ticket=sE_1lFPNoyhU_-1 "Click here to give kudos to this post.")

1

2

3

4

5

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

[Reply](https://community.checkpoint.com/t5/General-Topics/RX-OVR-drops-and-10-gb-hardware-buffer/td-p/24666)

[Timothy\_Hall](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/597)

MVP Gold

‎2018-09-0509:57 AM

[Show option menu](https://community.checkpoint.com/t5/General-Topics/RX-OVR-drops-and-10-gb-hardware-buffer/td-p/24666# "Show option menu")

- Mark as New
- Bookmark
- Subscribe
- Mute
- [Subscribe to RSS Feed](https://community.checkpoint.com/rss/message?board.id=general-topics&message.id=4928)
- [Permalink](https://community.checkpoint.com/t5/General-Topics/RX-OVR-drops-and-10-gb-hardware-buffer/m-p/24671/highlight/true#M4928)
- [Print](https://community.checkpoint.com/t5/forums/forumtopicprintpage/board-id/general-topics/message-id/4928/print-single-message/true/page/1)
- [Report Inappropriate Content](https://community.checkpoint.com/t5/notifications/notifymoderatorpage/message-uid/24671)

[In response to Daniel\_Westlund](https://community.checkpoint.com/t5/General-Topics/RX-OVR-drops-and-10-gb-hardware-buffer/m-p/24670/highlight/true#M4927)

OK now we are getting somewhere:

0) No carrier transitions, at least on the eth1-08 interface.  Looks like bond1 consists of eth1-05 and eth1-06, while bond2 is eth1-07 and eth1-08.  RX-DRP percentage is far less than the target of 0.1% though.

1) Looks like you only provided the ethtool stats for eth1-08, but is showing 99% misses/drops. There were 83 overruns probably caused by the ring buffer being full thus causing backpressure into the NIC buffer which was then overrun a few times.  I would expect the other interfaces are similar, see #3 below...

2) Inbound RX balancing of the bonds looks good, but TX numbers are far enough apart that you probably should set L3/L4 hash balancing if you haven't already, although you don't seem to be having any problems on the TX side.

3) Given this is a 13800 with 20 cores, you are almost certainly running with a default split of 2/18  (4/36 if SMT enabled) for CoreXL allocations.  So only two physical SND/IRQ cores are emptying the ring buffers of four very busy 1Gbps interfaces and they are not keeping up and causing drops/misses; if a large percentage of traffic is accelerated (use **fwaccel stats -s** to check) those 2 cores will be getting absolutely killed and seriously crimp the throughput of the box.

Would strongly recommend adjusting CoreXL split via **cpconfig**.  If "Accelerated pkts/Total pkts" is >50% as reported by **fwaccel stats -s** reduce number of kernel instances from 18 to 14 to allocate 6 SND/IRQ cores; you may also want to disable SMT/Hyperthreading in this instance.

If "Accelerated pkts/Total pkts" is <50% as reported by **fwaccel stats -s**reduce number of kernel instances from 18/36 to 16/32 to allocate more SND/IRQ cores and leave SMT/Hyperthreading on.

--

Second Edition of my "Max Power" Firewall Book

Now Available at[http://www.maxpowerfirewalls.com](http://www.maxpowerfirewalls.com/)

New Book: "Max Power 2026" Coming Soon

Check Point Firewall Performance Optimization

0

Kudos

[Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/24671?t:ac=board-id/general-topics/thread-id/4923&t:cp=kudos/contributions/tapletcontributionspage&ticket=sE_1lFPNoyhU_-1 "Click here to give kudos to this post.")

1

2

3

4

5

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

[Reply](https://community.checkpoint.com/t5/General-Topics/RX-OVR-drops-and-10-gb-hardware-buffer/td-p/24666)

[Daniel\_Westlund](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/11671)

Collaborator

‎2018-09-0511:11 AM

[Show option menu](https://community.checkpoint.com/t5/General-Topics/RX-OVR-drops-and-10-gb-hardware-buffer/td-p/24666# "Show option menu")

- Mark as New
- Bookmark
- Subscribe
- Mute
- [Subscribe to RSS Feed](https://community.checkpoint.com/rss/message?board.id=general-topics&message.id=4929)
- [Permalink](https://community.checkpoint.com/t5/General-Topics/RX-OVR-drops-and-10-gb-hardware-buffer/m-p/24672/highlight/true#M4929)
- [Print](https://community.checkpoint.com/t5/forums/forumtopicprintpage/board-id/general-topics/message-id/4929/print-single-message/true/page/1)
- [Report Inappropriate Content](https://community.checkpoint.com/t5/notifications/notifymoderatorpage/message-uid/24672)

[In response to Timothy\_Hall](https://community.checkpoint.com/t5/General-Topics/RX-OVR-drops-and-10-gb-hardware-buffer/m-p/24671/highlight/true#M4928)

Thanks again.  We are actually way below 50% acceleration because they have a ton of blades turned on, and we already have Hyperthreading enabled with 8 SNDs and 32 workers like you suggested.  Multiqueue is enabled on these interfaces (igb) and we added all 8 SNDs to multiqueue.  Our next plan is to change to Keep all connections on the policy install.  So, I don't know how to set L3/L4 hash balancing offhand but am looking into how to do that.

0

Kudos

[Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/24672?t:ac=board-id/general-topics/thread-id/4923&t:cp=kudos/contributions/tapletcontributionspage&ticket=sE_1lFPNoyhU_-1 "Click here to give kudos to this post.")

1

2

3

4

5

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

[Reply](https://community.checkpoint.com/t5/General-Topics/RX-OVR-drops-and-10-gb-hardware-buffer/td-p/24666)

[Timothy\_Hall](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/597)

MVP Gold

‎2018-09-0706:14 AM

[Show option menu](https://community.checkpoint.com/t5/General-Topics/RX-OVR-drops-and-10-gb-hardware-buffer/td-p/24666# "Show option menu")

- Mark as New
- Bookmark
- Subscribe
- Mute
- [Subscribe to RSS Feed](https://community.checkpoint.com/rss/message?board.id=general-topics&message.id=4930)
- [Permalink](https://community.checkpoint.com/t5/General-Topics/RX-OVR-drops-and-10-gb-hardware-buffer/m-p/24673/highlight/true#M4930)
- [Print](https://community.checkpoint.com/t5/forums/forumtopicprintpage/board-id/general-topics/message-id/4930/print-single-message/true/page/1)
- [Report Inappropriate Content](https://community.checkpoint.com/t5/notifications/notifymoderatorpage/message-uid/24673)

[In response to Daniel\_Westlund](https://community.checkpoint.com/t5/General-Topics/RX-OVR-drops-and-10-gb-hardware-buffer/m-p/24672/highlight/true#M4929)

Right since you have plenty of SND/IRQ instances, automatic interface affinity (assuming SecureXL is enabled) will eventually assign each firewall interface its own dedicated SND/IRQ core to empty its ring buffer.    If you are still experiencing RX-DRPs in that situation, that's the time to enable Multi-Queue on your busiest interfaces which you have already done.

You may want to run **sar -n EDEV** to see exactly when you are piling up those RX-DRPs.  If they are only happening around the time of policy installation that is expected to some degree, and setting "Keep all connections" under Connection Persistence will help.  If you are slowly accumulating them over time though, I'd argue that is not an actual problem since your RX-DRP rate is well below the generally recommended 0.1% (yours is actually 0.002%).  This is a rather deep topic; please see the "RX-DRP Analysis & Discussion" section of my book for a discussion about why we don't necessarily expect RX-DRP to always be zero, even on a well-tuned firewall.  RX-ERR and RX-OVR on the other hand are another matter entirely and should be zero or very close to it.

--

Second Edition of my "Max Power" Firewall Book

Now Available at [http://www.maxpowerfirewalls.com](http://www.maxpowerfirewalls.com/)

New Book: "Max Power 2026" Coming Soon

Check Point Firewall Performance Optimization

[2\\
\\
\\
Kudos](https://community.checkpoint.com/t5/kudos/messagepage/board-id/general-topics/message-id/4930/tab/all-users "Click here to see who gave kudos to this post.")

[Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/24673?t:ac=board-id/general-topics/thread-id/4923&t:cp=kudos/contributions/tapletcontributionspage&ticket=sE_1lFPNoyhU_-1 "Click here to give kudos to this post.")

1

2

3

4

5

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

[Reply](https://community.checkpoint.com/t5/General-Topics/RX-OVR-drops-and-10-gb-hardware-buffer/td-p/24666)

[Daniel\_Westlund](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/11671)

Collaborator

‎2018-09-0703:03 PM

[Show option menu](https://community.checkpoint.com/t5/General-Topics/RX-OVR-drops-and-10-gb-hardware-buffer/td-p/24666# "Show option menu")

- Mark as New
- Bookmark
- Subscribe
- Mute
- [Subscribe to RSS Feed](https://community.checkpoint.com/rss/message?board.id=general-topics&message.id=4931)
- [Permalink](https://community.checkpoint.com/t5/General-Topics/RX-OVR-drops-and-10-gb-hardware-buffer/m-p/24674/highlight/true#M4931)
- [Print](https://community.checkpoint.com/t5/forums/forumtopicprintpage/board-id/general-topics/message-id/4931/print-single-message/true/page/1)
- [Report Inappropriate Content](https://community.checkpoint.com/t5/notifications/notifymoderatorpage/message-uid/24674)

[In response to Timothy\_Hall](https://community.checkpoint.com/t5/General-Topics/RX-OVR-drops-and-10-gb-hardware-buffer/m-p/24673/highlight/true#M4930)

Thank you.  We are sure the drops in question are happening on policy push so I think you're right that Keep all connections is a good next step.  23900s are on the way as well.

0

Kudos

[Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/24674?t:ac=board-id/general-topics/thread-id/4923&t:cp=kudos/contributions/tapletcontributionspage&ticket=sE_1lFPNoyhU_-1 "Click here to give kudos to this post.")

1

2

3

4

5

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

[Reply](https://community.checkpoint.com/t5/General-Topics/RX-OVR-drops-and-10-gb-hardware-buffer/td-p/24666)

Post Reply

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

| User | Count |
| --- | --- |
| <br>[israelfds95](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/93117) | 13 |
| <br>[HeikoAnkenbrand](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/21670) | 7 |
| <br>[simonemantovani](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/79070) | 5 |
| <br>[emmap](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/71054) | 3 |
| <br>[Steffen\_Appel](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/10477) | 2 |
| <br>[Kaspars\_Zibarts](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/11456) | 1 |
| <br>[Alex-](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/10384) | 1 |
| <br>[Danny](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/687) | 1 |
| <br>[Bob\_Zimmerman](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/27871) | 1 |
| <br>[DH](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/25118) | 1 |

[View All ≫](https://community.checkpoint.com/t5/forums/kudosleaderboardpage/board-id/general-topics/timerange/one_month/page/1/tab/authors)

Trending Discussions

[Five Habits That Improved My Check Point Deployments](https://community.checkpoint.com/t5/General-Topics/Five-Habits-That-Improved-My-Check-Point-Deployments/td-p/279760)

[Automatically Renew VPN Certificates](https://community.checkpoint.com/t5/General-Topics/Automatically-Renew-VPN-Certificates/td-p/279072)

[Snapshot and /boot disk space full](https://community.checkpoint.com/t5/General-Topics/Snapshot-and-boot-disk-space-full/td-p/280183)

Upcoming Events

Sort by:

- [All](https://community.checkpoint.com/t5/General-Topics/RX-OVR-drops-and-10-gb-hardware-buffer/td-p/24666#)
- [Virtual](https://community.checkpoint.com/t5/General-Topics/RX-OVR-drops-and-10-gb-hardware-buffer/td-p/24666#)
- [In-Person](https://community.checkpoint.com/t5/General-Topics/RX-OVR-drops-and-10-gb-hardware-buffer/td-p/24666#)

[Virtual](https://community.checkpoint.com/labels/Virtual)

Tue 28 Jul 2026 @ 11:00 AM (EDT)

[Under the Hood - Check Point and Illumio – Modern Network Defense Against AI-Based Threats](https://community.checkpoint.com/t5/CheckMates-Events/Under-the-Hood-Check-Point-and-Illumio-Modern-Network-Defense/ev-p/279701)

[Virtual](https://community.checkpoint.com/labels/Virtual)

Wed 29 Jul 2026 @ 12:00 PM (SGT)

[The AI Security Report 2026: A Turning Point for Enterprise Defense - SGT](https://community.checkpoint.com/t5/CheckMates-Events/The-AI-Security-Report-2026-A-Turning-Point-for-Enterprise/ev-p/280019)

[Virtual](https://community.checkpoint.com/labels/Virtual)

Wed 29 Jul 2026 @ 02:00 PM (IDT)

[The AI Security Report 2026: A Turning Point for Enterprise Defense - AMER](https://community.checkpoint.com/t5/CheckMates-Events/The-AI-Security-Report-2026-A-Turning-Point-for-Enterprise/ev-p/280021)

[Virtual](https://community.checkpoint.com/labels/Virtual)

Wed 29 Jul 2026 @ 03:00 PM (CEST)

[The AI Security Report 2026: A Turning Point for Enterprise Defense EMEA](https://community.checkpoint.com/t5/CheckMates-Events/The-AI-Security-Report-2026-A-Turning-Point-for-Enterprise/ev-p/280020)

[Virtual](https://community.checkpoint.com/labels/Virtual)

Wed 29 Jul 2026 @ 11:00 AM (EDT)

[TechTalk: On-Premise SD-WAN Management](https://community.checkpoint.com/t5/CheckMates-Events/TechTalk-On-Premise-SD-WAN-Management/ev-p/279370)

Thu 30 Jul 2026 @ 11:30 AM (CDT)

[CheckMates Live DFW: Agentic AI Security Deep Dive & Hands-On](https://community.checkpoint.com/t5/CheckMates-Events/CheckMates-Live-DFW-Agentic-AI-Security-Deep-Dive-amp-Hands-On/ev-p/279920)

[Virtual](https://community.checkpoint.com/labels/Virtual)

Tue 28 Jul 2026 @ 11:00 AM (EDT)

[Virtual](https://community.checkpoint.com/labels/Virtual)

Wed 29 Jul 2026 @ 12:00 PM (SGT)

[Virtual](https://community.checkpoint.com/labels/Virtual)

Wed 29 Jul 2026 @ 02:00 PM (IDT)

[Virtual](https://community.checkpoint.com/labels/Virtual)

Wed 29 Jul 2026 @ 03:00 PM (CEST)

[Virtual](https://community.checkpoint.com/labels/Virtual)

Wed 29 Jul 2026 @ 11:00 AM (EDT)

[TechTalk: On-Premise SD-WAN Management](https://community.checkpoint.com/t5/CheckMates-Events/TechTalk-On-Premise-SD-WAN-Management/ev-p/279370)

[Virtual](https://community.checkpoint.com/labels/Virtual)

Thu 30 Jul 2026 @ 10:00 AM (PDT)

[AI Security Masters E12: READY OR NOT: Securing the AI Enterprise 4/5 - AI Gateway](https://community.checkpoint.com/t5/CheckMates-Events/AI-Security-Masters-E12-READY-OR-NOT-Securing-the-AI-Enterprise/ev-p/277411)

[In-Person](https://community.checkpoint.com/labels/In-Person)

Tue 11 Aug 2026 @ 11:30 AM (EDT)

[New York City: Agentic AI Security Deep Dive & Hands-On](https://community.checkpoint.com/t5/CheckMates-Events/New-York-City-Agentic-AI-Security-Deep-Dive-amp-Hands-On/ev-p/279476)

[In-Person](https://community.checkpoint.com/labels/In-Person)

Thu 13 Aug 2026 @ 11:30 AM (EDT)

[Waltham, MA: Agentic AI Security Deep Dive & Hands-On](https://community.checkpoint.com/t5/CheckMates-Events/Waltham-MA-Agentic-AI-Security-Deep-Dive-amp-Hands-On/ev-p/279475)

[In-Person](https://community.checkpoint.com/labels/In-Person)

Thu 20 Aug 2026 @ 08:30 AM (COT)

[Medellin: Workspace Evolution: Hybrid Mesh Management - Visibilidad, Automatización e IA](https://community.checkpoint.com/t5/CheckMates-Events/Medellin-Workspace-Evolution-Hybrid-Mesh-Management-Visibilidad/ev-p/280003)

[In-Person](https://community.checkpoint.com/labels/In-Person)

Thu 20 Aug 2026 @ 06:00 PM (COT)

[Medellin: Workspace Intelligence: IA Generativa en Acción para Equipos de Seguridad](https://community.checkpoint.com/t5/CheckMates-Events/Medellin-Workspace-Intelligence-IA-Generativa-en-Acci%C3%B3n-para/ev-p/280004)

[In-Person](https://community.checkpoint.com/labels/In-Person)

Thu 27 Aug 2026 @ 09:00 AM (CEST)

[Check Point Hands-On SASE and Cloud Workshop - Zurich](https://community.checkpoint.com/t5/CheckMates-Events/Check-Point-Hands-On-SASE-and-Cloud-Workshop-Zurich/ev-p/279914)

[In-Person](https://community.checkpoint.com/labels/In-Person)

Wed 21 Oct 2026 @ 09:00 AM (BST)

[AI Security Workshop - Glasgow](https://community.checkpoint.com/t5/CheckMates-Events/AI-Security-Workshop-Glasgow/ev-p/278505)

[CheckMates Events](https://community.checkpoint.com/t5/CheckMates-Events/eb-p/events)

[Top](https://community.checkpoint.com/t5/General-Topics/RX-OVR-drops-and-10-gb-hardware-buffer/td-p/24666)

About CheckMates

- [Getting Started & FAQ](https://community.checkpoint.com/t5/help/faqpage)
- [Community Guidelines](https://community.checkpoint.com/t5/user/TermsOfServicePage)

Learn Check Point

- [Check Point for Beginners](https://community.checkpoint.com/t5/Check-Point-for-Beginners-2-0/bg-p/check-point-for-beginners-2-0)
- [Check Point Trivia](https://community.checkpoint.com/t5/Check-Point-Trivia/bg-p/trivia)
- [CheckFlix Videos](https://community.checkpoint.com/t5/CheckFlix/ct-p/checkflix)

Advanced Learning

- [Check Point Security Masters](https://community.checkpoint.com/t5/Check-Point-Security-Masters/gp-p/ccsm)
- [Tip of the Week](https://community.checkpoint.com/t5/SecureKnowledge-Tip-of-the-Week/bg-p/secureknowledge)
- [TechTalks](https://community.checkpoint.com/t5/TechTalks/ct-p/techtalks%20role=)
- [Training and Certification](https://community.checkpoint.com/t5/Training-and-Certification/bd-p/training-and-certification)

Resources

- [CheckMates Toolbox](https://community.checkpoint.com/t5/CheckMates-Toolbox/ct-p/CheckMatesToolbox)
- [Developers (Code Hub)](https://community.checkpoint.com/t5/Developers-API-CLI/bd-p/codehub)
- [Product Announcements](https://community.checkpoint.com/t5/Product-Announcements/bg-p/products-blog)
- [Upcoming Events](https://community.checkpoint.com/t5/Upcoming-Events/bg-p/checkmates-live)

Non-English Discussions

- [Español](https://community.checkpoint.com/t5/Espa%C3%B1ol/bd-p/spanish)
- [French](https://community.checkpoint.com/t5/Fran%C3%A7ais/bd-p/francais)
- [Japanese](https://community.checkpoint.com/t5/Japanese-%E6%97%A5%E6%9C%AC%E8%AA%9E/bd-p/Japanese)
- [Português](https://community.checkpoint.com/t5/Portugu%C3%AAs/bd-p/portuguese)
- [Russian](https://community.checkpoint.com/t5/Russian/bd-p/russian)
- [Chinese](https://community.checkpoint.com/t5/Chinese/bd-p/taiwan)

YOU DESERVE THE BEST SECURITY

We’re Social. Follow Us [CheckMates on LinkedIn](http://linkedin.com/company/cpcheckmates)  [Check Point on YouTube](https://www.youtube.com/user/CPGlobal) [CheckMates on Facebook](https://www.facebook.com/cpcheckmates/) [CheckMates on Instagram](https://www.instagram.com/cpcheckmates/)

©1994-2026 Check Point Software Technologies Ltd. All rights reserved. [Copyright](https://www.checkpoint.com/copyright/) [Privacy Policy](https://www.checkpoint.com/privacy/) [About Us](https://www.checkpoint.com/about-us/) [UserCenter](https://usercenter.checkpoint.com/)

Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.

Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.