> Source: [sk110672](https://support.checkpoint.com/results/sk/sk110672)

# sk110672 - When a TCP connection ends, its entry in the Connections Table appears with a timeout value of "TCP start timeout" instead of expected "TCP end timeout"

| Property | Value |
|----------|-------|
| Solution ID | sk110672 |
| Date Created | 2016-03-23 |
| Last Modified | 2021-02-21 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * When a TCP connection ends, its entry in the Connections Table (id 8158) appears with a timeout value of "TCP start timeout" instead of expected "TCP end timeout".

  *Example*:
  1. In SmartDashboard - go to *Policy* menu - click on *Global Properties* - go to *Stateful Inspection*:

     * Value of "TCP start timeout" is 25 seconds
     * Value of "TCP end timeout" is 20 seconds

     [![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk110672/TCP_Timers.png)](https://sc1.checkpoint.com/sc/SolutionsStatics/sk110672/TCP_Timers.png "Click the image to see it in full size in a new tab/window")
  2. TCP connection in the Connections Table (id 8158) after it is just established (run '`fw tab -t 8158`' command):

     \<00000000, c0a80a02, 0000ee33, 0a000002, 00000015, 00000006; 0001c001, 00046080, 00000001, 00000149, 000000fb, 56f240ed, 00000000, 5a861eac, c0000000, 00000002, 00000002, 00000003, 00000003, 02000000, 00000000, 00000008, 00000000, 00000000, 00000000, 00000000, 00000000, 00000000, 00000000, 00000000, 00000000, 00000000, 00000000, 00000000, 00000000, 00000000, eabac800, 00000000, 00000000; ***3598/3600***\>
  3. TCP connection in the Connections Table (id 8158) after it has ended (run '`fw tab -t 8158`' command):

     \<00000000, c0a80a02, 0000ee33, 0a000002, 00000015, 00000006; 0001c001, 00046080, 00000001, 00000149, 000000fb, 56f240ed, 00000000, 5a861eac, c0000000, 00000002, 00000002, 00000003, 00000003, 02000000, 00000000, 00000008, 00000000, 00000000, 00000000, 00000000, 00000000, 00000000, 00000000, 00000000, 00000000, 00000000, 00000000, 00000000, 00000000, 00000000, eabac800, 00000000, 00000000; ***25/25***\>
* After disabling SecureXL, when a TCP connection ends, its entry in the Connections Table (id 8158) appears with an expected timeout value of "TCP end timeout" (based on the example above - 20 seconds).

## Cause

By design, SecureXL adds additional 5 seconds to the configured "TCP end timeout" to make sure that the SecureXL module has enough time to update the FireWall kernel that the TCP connection has expired.

In the example above, the "TCP end timeout" is set to 20 seconds. Due to SecureXL design, TCP connection's entry would appear with a timeout value of 20 seconds + 5 seconds = 25 seconds.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content