> Source: [sk122452](https://support.checkpoint.com/results/sk/sk122452)

# sk122452 - Number of objects in ip_dst_cache keeps growing until it exceeds the limit

| Property | Value |
|----------|-------|
| Solution ID | sk122452 |
| Date Created | 2018-02-24 |
| Last Modified | 2022-08-08 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * *#cat /proc/slabinfo \| grep ip_dst_cache* shows that the number of objects in *ip_dst_cache* keeps growing until it exceeds the limit. After that, new connections to the gateway are rejected.
* There are a lot of error logs showing in message log.  
  +++++++++++++++++++++++++=  
  2 Sep 4 07:46:55 2017 CP-5600-02 kernel: dst cache overflow  
  4 Sep 4 07:47:01 2017 CP-5600-02 kernel: dst cache overflow  
  109 Sep 4 07:47:07 2017 CP-5600-02 kernel: dst cache overflow  
  111 Sep 4 07:47:08 2017 CP-5600-02 kernel: dst cache overflow  
  113 Sep 4 07:47:13 2017 CP-5600-02 kernel: dst cache overflow  
  115 Sep 4 07:47:18 2017 CP-5600-02 kernel: dst cache overflow  
  117 Sep 4 07:47:23 2017 CP-5600-02 kernel: dst cache overflow  
  119 Sep 4 07:47:29 2017 CP-5600-02 kernel: dst cache overflow  
  121 Sep 4 07:47:33 2017 CP-5600-02 kernel: dst cache overflow  
  124 Sep 4 07:47:39 2017 CP-5600-02 kernel: dst cache overflow

## Cause

[CVE-2009-0778](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0778)

The *icmp_send* function in *net/ipv4/icmp.c* in the Linux kernel before 2.6.25, when configured as a router with a REJECT route, does not properly manage the Protocol Independent Destination Cache (aka DST) in some situations involving transmission of an ICMP Host Unreachable message, which allows remote attackers to cause a denial of service (connectivity outage) by sending a large series of packets to many destination IP addresses within this REJECT route, related to an "rt_cache leak."

## Solution

This problem was fixed. The fix is included in:

* **[Check Point R80.20](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk122485)**
* **[Check Point R80.10 Jumbo Hotfix](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk116380) (since Take_151)**
* **[Check Point R77.30 Jumbo Hotfix](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk106162) (since Take_338)**

Check Point recommends to always [upgrade to the most recent version](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=overview&product=435).  

<br />

If you do not wish to upgrade, [contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.   
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.   
For faster resolution and verification please collect [CPinfo](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92739) files from the Security Management and Security Gateways involved in the case.

<br />

As a workround, the "syn attack" IPS protection can efficiently protect the cache from constantly increasing.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content