Cannot reach websites because of "Streaming Engine: TCP Invalid Retransmission" drops

Product: IPS
Version: R81.10 (EOS), R81.20, R82
Last Modified: 2025-12-21

Symptoms

• Decrypted traffic traversing the Security Gateway gets dropped for:

  Invalid segment retransmission. Packet dropped. Please refer to sk172266. Streaming Engine: TCP Invalid Retransmission

Traffic flow:

Client > Decryption Device > Check Point Gateway > Re-encryption Device > Server

• Disabling Brotli Accept-Encoding on the client or on the decryption device resolves the issue.

Cause

A TCP retransmission was sent because the server did not respond to the original request. In the original packet on the Check Point Security Gateway, Brotli Accept-Encoding was removed because it is not supported (see sk179967). When a TCP retransmission was sent, the packet contained Brotli Accept-Encoding, but the original packet no longer had it on the Check Point Security Gateway. This is the reason for the "TCP Invalid Retransmission" drops.

Solution

This problem was fixed. The fix is included in:

• Jumbo Hotfix Accumulator for R82 starting from Take 44
• Jumbo Hotfix Accumulator for R81.20 starting from Take 99
• Jumbo Hotfix Accumulator for R81.10 starting from Take 183

If you choose not to upgrade, Check Point can supply a Hotfix. Contact Check Point Support to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.

For faster resolution and verification, please collect CPinfo files from the Security Management Server and Security Gateways involved in the case.

Hotfix installation instructions:
Refer to sk168597 - How to install a Hotfix.

NOTE

This solution has been verified for the specific scenario, described by the combination of Product, Version and Symptoms. It may not work in other scenarios.

Article Properties

Access Level: General
Status: Approved by TAC
Date Created: 2023-07-20
Last Modified: 2025-12-21