> Source: [sk1000111](https://support.checkpoint.com/results/sk/sk1000111) # sk1000111 - rx_errors and rx_length errors continuously increase on Check Point Firewall with 100 Gigabit Ethernet interfaces | Property | Value | |----------|-------| | Solution ID | sk1000111 | | Date Created | 2026-09-04 | | Last Modified | 2026-09-10 | | Technical Level | General | | Products | Check Point Firewall | | Versions | R82.20 | ## Symptoms - * Multiple Security Gateways show increasing interface error counters on 100 Gigabit Ethernet interfaces. * Health Check Point (HCP) reports interface error counters above the 0.5% threshold on the interface. * HCP reports high receive (RX) error counters, including `rx_errors` and `rx_length_errors. ` * The `ifconfig` output shows RX errors and frame errors that increase on the affected interface. * Transmit (TX) errors, TX drops, RX drops, overruns, and carrier errors remain at zero. * The affected interface uses the Mellanox `mlx5_core` driver. * The `ethtool` statistics show that: * `rx_oversize_pkts_phy` * `rx_jabbers_phy` increase at approximately the same rate as Linux: * `rx_errors` * `rx_length_errors` * Physical-layer error counters do not increase: * `rx_crc_errors_phy` is `0`. * `rx_symbol_err_phy` is `0`. * `rx_discards_phy` is near `0`. * `rx_oversize_pkts_sw_drop` is `0`. * The directly connected switch interface is configured with a Maximum Transmission Unit (MTU) of `1500`, but switch counters show many jumbo packets transmitted toward the Security Gateway. * Example: ```text Interface: eth1-02 rx_errors: 39872082 rx_length_errors: 39872082 TX errors: 0 TX dropped: 0 RX dropped: 0 overruns: 0 carrier errors: 0 ``` * Example of Mellanox hardware counters: ```text rx_oversize_pkts_phy: rx_jabbers_phy: rx_crc_errors_phy: 0 rx_symbol_err_phy: 0 rx_oversize_pkts_sw_drop: 0 ``` ## Cause The Security Gateway receives oversized Ethernet frames. For Mellanox 100 Gigabit Ethernet adapters, oversized frames increment the hardware counters: * `rx_oversize_pkts_phy` * `rx_jabbers_phy` Gaia and Linux reflect these events through: * `rx_errors` * `rx_length_errors` The available statistics do not indicate a physical-link problem because CRC errors, symbol errors, discards, and software-drop counters remain at or near zero. If the Security Gateway interface is configured with an MTU of 1500 and jumbo frames are observed arriving on the link, traffic larger than the configured frame size is reaching the interface. This condition is typically caused by MTU inconsistencies elsewhere in the network path. ## Solution 1. **Make sure that oversized frames are causing the errors** 1. Run these commands in Expert mode: This example uses the eth1-02 interface ``` ifconfig eth1-02 ethtool -S eth1-02 | egrep 'rx_oversize_pkts_phy|rx_jabbers_phy|rx_crc_errors_phy|rx_symbol_err_phy|rx_discards_phy|rx_oversize_pkts_sw_drop' ``` 2. Make sure that: * `rx_errors` and `rx_length_errors` increase. * `rx_oversize_pkts_phy` and `rx_jabbers_phy` increase at a similar rate. * `rx_crc_errors_phy` and `rx_symbol_err_phy` remain at `0`. 2. **Confirm the configured MTU on the affected interface** On the affected Security Gateway, run this command in Gaia Clish: `show interface ` For example: `show interface eth1-02` If the interface is part of a cluster, check the same interface on each Cluster Member. 3. **Investigate the adjacent network device:** On the directly connected switch: * Verify the interface MTU. * Review jumbo-frame and packet counters. * Identify the source of oversized traffic. * Check VLANs, trunks, routers, servers, and intermediate switches for MTU mismatches. 4. **Implement one of the following remediation options.** * **Option A - Maintain MTU 1500** * Keep the Security Gateway interface MTU at `1500`. * Stop devices in the path from sending jumbo frames toward this interface. * Make sure all connected switch ports, trunks, VLANs, and endpoints use an MTU that matches the intended path MTU. * **Option B - Enable jumbo frames end-to-end:** Use this option only if the Security Gateway appliance, interface, driver, and connected network devices support jumbo frames. Before making changes, review [sk111407](https://support.checkpoint.com/results/sk/sk111407) --- Support for Jumbo Frames in Check Point Appliances Configure a consistent MTU across: * Security Gateway interfaces. * All cluster members. * Connected switch ports. * VLANs and trunks. * Intermediate network devices. * End hosts that generate jumbo traffic 5. **Configure the MTU on the Security Gateway, if jumbo frames are supported** On the affected Security Gateway, run these commands in Gaia Clish: ```bash set interface mtu ``` ```bash save config ``` For example: ```bash set interface eth1-02 mtu 9000 ``` ```bash save config ``` **Notes:** * Replace 9000 with a supported MTU value appropriate for the environment. * Repeat the configuration on each applicable Cluster Member. 6. Depending on the platform and software version, additional steps may be required for MTU changes to take full effect. Follow the applicable product documentation and maintenance procedures. **Important** * A reboot of the Security Gateway interrupts the traffic * In a cluster, plan the change during a maintenance window and follow your organization's cluster change procedure. 7. **Verify operation** 1. After the Security Gateway and connected devices use the correct MTU, test jumbo-frame connectivity. On the Security Gateway, run this command in Expert Mode: ```bash ping -M do -s 8972 ``` Use a reachable IP address across the intended jumbo-frame path. For example: ```bash ping -M do -s 8972 192.168.10.10 ``` Note: For an MTU of `9000`, an Internet Control Message Protocol (ICMP) payload size of `8972` tests a full-size IPv4 frame without fragmentation. Expected result: ```text 64 bytes from 192.168.10.10: icmp_seq=1 ttl= time= ms ``` 2. Monitor the interface counters: ```bash ifconfig eth1-02 ethtool -S eth1-02 | egrep 'rx_oversize_pkts_phy|rx_jabbers_phy|rx_crc_errors_phy|rx_symbol_err_phy|rx_oversize_pkts_sw_drop' ``` Make sure that `rx_errors`, `rx_length_errors`, `rx_oversize_pkts_phy`, and `rx_jabbers_phy` no longer increase during normal traffic. **Important Notes** * Matching Mellanox oversized-frame counters and Linux RX error counters typically indicate oversized frames rather than a driver defect. * Jumbo frames must be configured consistently across the entire traffic path. * Verify platform-specific jumbo-frame support before changing MTU values. Refer to [sk111407](https://support.checkpoint.com/results/sk/sk111407). * Use Gaia Clish to configure MTU persistently. Do not rely on temporary changes to the Expert Mode interface for production configuration. * Reboots and MTU changes can cause traffic interruption. Schedule the change during an approved maintenance window. * In clustered environments, maintain consistent MTU settings across all members. --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content