sk183040 - HealthCheck Point reports "rx_length_errors" for Security Group Members

HealthCheck Point reports "rx_length_errors" for Security Group Members

Product: Maestro HyperScale Firewall, Security Gateways
Version: R81.20, R82
Last Modified: 2025-11-05

Symptoms

HealthCheck Point (HCP) reports "rx_length_errors" for Security Group Members. The error counter increases daily by approximately 20,000.

Definition:

An "rx_length_error" occurs when a Network Interface Card (NIC) detects an Ethernet packet with an invalid length.

Sample Error Output:

[Expert@Hostname-01:0]# g_all 'ethtool -S ethsBP1-01 | grep error | grep -v ': 0'"

1_01:
      rx_length_errors.nic: 33798

1_02:
      rx_length_errors.nic: 11461

The following command show that the driver type is ice:

[Expert@HostName-ch0x-0x:0]# ethtool -i ethsBP1-01

driver: ice

version: 1.10.1.2_cp

firmware-version: 4.20 0x800178e2 1.3346.0

expansion-rom-version:

bus-info: 0000:18:00.1

supports-statistics: yes

supports-test: yes

supports-eeprom-access: yes

supports-register-dump: yes

supports-priv-flags: yes

Cause

An "rx_length_error" occurs under these conditions:

The Ethernet packet is longer than 64 bytes.
The Length/Type field of the packet contains a value smaller than the number of remaining bytes in the packet.

This error can occur if a short packet is padded to 64 bytes and a VLAN tag is inserted without removing the padding bytes.

Solution

This is not a Check Point issue. The issue is cosmetic and does not have an effect on network traffic flows. The rx_length_errors statistic is not meaningful and can be safely ignored.

According to Linux kernel commit f9f9de23dc88, the statistic was removed from the ice driver in the upstream Linux kernel due to its lack of relevance.

For additional details, refer to ESXi logs show RX length errors on Intel E810 Adapters with icen driver versions less than 1.14.2.0. This change aligns with icen driver version 1.14.2.0 and later, where this counter is no longer reported. On Check Point Security Gateway, the ice driver version will be upgraded in a future major release.

This problem was fixed. The fix is included in:

Jumbo Hotfix Accumulator for R82 starting from Take 44
Jumbo Hotfix Accumulator for R81.20 starting from Take 119

If you choose not to upgrade, Check Point can supply a Hotfix. Contact Check Point Support to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.

For faster resolution and verification, please collect CPinfo files from the Security Management Server and Security Gateways involved in the case.

Hotfix installation instructions:

Refer to sk168597 - How to install a Hotfix.

NOTE

This solution has been verified for the specific scenario, described by the combination of Product, Version and Symptoms. It may not work in other scenarios.

Article Properties

Access Level: General
Status: Approved by TAC
Date Created: 2025-01-27
Last Modified: 2025-11-05