> Source: [sk126373](https://support.checkpoint.com/results/sk/sk126373)

# sk126373 - High memory consumption on SMB appliances if Anti ARP Spoofing is set to 'Detect'

| Property | Value |
|----------|-------|
| Solution ID | sk126373 |
| Date Created | 2018-05-08 |
| Last Modified | 2018-05-08 |
| Technical Level | General |
| Products | Spark Firewall (Locally Managed) |
| Versions | R82.00.X, R81.10.X |

## Symptoms

- * SMB appliances memory consumption increases to a point that it runs out of memory and freezes \[becomes unresponsive\].
* A lot of "Out of memory: Kill process ..." messages are seen once starting the appliance in debug mode or connecting to it using a serial cable.
* skbuff_head_cache increase dramatically, this can be seen when issuing the command: `watch cat /proc/slabinfo | grep skb`.
* Anti ARP spoofing mode is set to "Detect" instead of the default value which is "Off" , in Device -\> Advanced Settings.

## Cause

ARP spoofing option caused a memory leak in the OS once it is set to 'Detect'.

## Solution

[Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.   
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.   
For faster resolution and verification please collect [CPinfo](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92739) files from the Security Management and Security Gateways involved in the case.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content