# HealthCheck Point reports "rx_length_errors" for Security Group Members

**Product:** Maestro HyperScale Firewall, Security Gateways  
**Version:** R81.20, R82  
**Last Modified:** 2025-11-05

## Symptoms

- HealthCheck Point (HCP) reports "`rx_length_errors`" for Security Group Members. The error counter increases daily by approximately 20,000.

**Definition**:

An "`rx_length_error`" occurs when a Network Interface Card (NIC) detects an Ethernet packet with an invalid length.

**Sample Error Output**:

```
[Expert@Hostname-01:0]# g_all 'ethtool -S ethsBP1-01 | grep error | grep -v ': 0'"

1_01:
      rx_length_errors.nic: 33798

1_02:
      rx_length_errors.nic: 11461

```

- The following command show that the driver type is `ice`:

`[Expert@HostName-ch0x-0x:0]# ethtool -i ethsBP1-01`

`driver: ice`

`version: 1.10.1.2_cp`

`firmware-version: 4.20 0x800178e2 1.3346.0`

`expansion-rom-version:`

`bus-info: 0000:18:00.1`

`supports-statistics: yes`

`supports-test: yes`

`supports-eeprom-access: yes`

`supports-register-dump: yes`

`supports-priv-flags: yes`

## Cause

An "`rx_length_error`" occurs under these conditions:

- The Ethernet packet is longer than 64 bytes.
- The Length/Type field of the packet contains a value smaller than the number of remaining bytes in the packet.

This error can occur if a short packet is padded to 64 bytes and a VLAN tag is inserted without removing the padding bytes.

## Solution

This is not a Check Point issue. The issue is cosmetic and does not have an effect on network traffic flows. The `rx_length_errors` statistic is not meaningful and can be safely ignored.

According to Linux kernel commit [f9f9de23dc88](https://github.com/torvalds/linux/commit/f9f9de23dc88670564a8e2448750d88398ea3555), the statistic was removed from the `ice` driver in the upstream Linux kernel due to its lack of relevance.

For additional details, refer to [ESXi logs show RX length errors on Intel E810 Adapters with icen driver versions less than 1.14.2.0](https://datacentersupport.lenovo.com/us/en/products/servers/thinksystem/sr650/7x06/solutions/tt2787-esxi-logs-show-rx-length-errors-on-intel-e810-adapters-with-icen-driver-versions-less-than-11420-lenovo-thinksystem#Details_HT). This change aligns with icen driver version 1.14.2.0 and later, where this counter is no longer reported. On Check Point Security Gateway, the `ice` driver version will be upgraded in a future major release.

This problem was fixed. The fix is included in:

- [Jumbo Hotfix Accumulator for R82](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82/Default.htm) starting from Take 44
- [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 119

If you choose not to upgrade, Check Point can supply a **Hotfix**. [Contact Check Point Support](https://www.checkpoint.com/support-services/.contact-support/) to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.

For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case.

**Hotfix installation instructions:**

Refer to [sk168597 - How to install a Hotfix](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk168597).

#### NOTE

This solution has been verified for the specific scenario, described by the combination of Product, Version and Symptoms. It may not work in other scenarios.

## Article Properties

**Access Level:** General  
**Status:** Approved by TAC  
**Date Created:** 2025-01-27  
**Last Modified:** 2025-11-05