> Source: [sk123075](https://support.checkpoint.com/results/sk/sk123075)

# sk123075 - Anti-Bot is dropping traffic although it is disabled

| Property | Value |
|----------|-------|
| Solution ID | sk123075 |
| Date Created | 2018-02-22 |
| Last Modified | 2021-01-18 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- * Traffic is dropped by the Anti-Bot \[even if the blade is disabled\].

* On kernel debug (On R80.10: fw ctl debug -m MALWARE + all; fw ctl debug -m fw + conn vm drop. On R77.30 and below: fw ctl debug -m fw + malware conn vm drop) the following logs are seen:  

  `[fw4_0];xxxxxxxxxxx:{policy} : fw_mal_post_logsup_abs: logsup_acc_update() failed;`  
  `
  [fw4_0];xxxxxxxxxxx:{policy} : fw_mal_module_send_log: post_logsup_cb() failed;`  
  `
  [fw4_0];fw_log_drop_ex: Packet proto=6 172.20.x.x:[port_number] > 172.20.y.y:[port_number] dropped by fw_handle_first_packet Reason: Anti Malware;`  
  `
  [fw4_0];After VM: < dir 0, 172.20.x.x:[port_number] > 172.20.y.y:[port_number] IPP 6 > (len=48) TCP flags=0x2 (SYN), seq=1f215f18, ack=0, data end=1f215f19 ;`  
  `
  [fw4_0];VM Final action=DROP;`

* SmartView Tracker drop log for "Rule base match failure"

## Cause

The *mal_conns* table has reached its limit.

In R80.10, the timeout of each entry for mal_conns table changed to 130 seconds \[instead of 10 seconds in R77.30\]. When working with R80.10 VSX, the mal_conns table limit will be 25,000.

When the mal_conns table reaches it's limit, it will drop every connection that should be inspected by Threat Prevention blades.

## Solution

This problem was fixed. The fix is included in:

* [Check Point R80.20](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk122485)

Check Point recommends to always upgrade to the most recent version ([upgrade Security Gateway](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=435) / [upgrade Cluster](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=428) / [upgrade Security Management Server](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=184) / [upgrade Multi-Domain Security Management Server](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=166)).

For **other [supported](http://www.checkpoint.com/support-services/support-life-cycle-policy/index.html) versions** , Check Point can supply a **Hotfix** . [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.  
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case.

The limit of this table can be changed by demand with the following kernel parameter:

*fw ctl set int mal_conns_dep_limit*

The *mal_conns* limit can be configured as a percentage of the connections limit when the default is 50%.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content