> Source: [sk111823](https://support.checkpoint.com/results/sk/sk111823)

# sk111823 - Only one of the two subordinate interfaces handles most of the traffic in 802.3ad Bond with Transmit Hash Policy "Layer 2"

| Property | Value |
|----------|-------|
| Solution ID | sk111823 |
| Date Created | 2016-06-05 |
| Last Modified | 2025-01-21 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- Output of "`netstat -ni`" command and traffic capture show that only one of the two physical slave interfaces in 802.3ad Load Sharing Bond interface handles most of the traffic.

## Cause

Since Bond interface inherits its MAC address from one of the physical slave interfaces, this MAC address will be static for the session.

Default Transmit Hash Policy for 802.3ad Load Sharing Bond is "Layer 2", which uses XOR of hardware MAC addresses - i.e., \[\[(Source_MAC) *XOR* (Destination_MAC)\] % 2\].  
All variables in the above formula are constants, because MAC addresses between the links do not change.  
As a result, most packets will be distributed via the same physical slave interface of the Bond.

The bond mechanism will dispatch the traffic among the slaves, based on the transmit policy. If the transmit policy is changed to layer 3 for example, the decision will be made based on the IP addresses of incoming packets, which in case of layer 3 devices usage, could be a lot and contribute to the load distribution between the slaves.

In a scenario that we are using Layer 2 policy, and we have many layer 2 devices in the network, users will benefit from layer 2 Transmit Hash Policy, as the incoming traffic will be forwarded from multiple layer 2 sources.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content