> Source: [sk169984](https://support.checkpoint.com/results/sk/sk169984)

# sk169984 - Download of file larger than 2GB is stopped after downloading 2GB of the file due to "Dropping packet with old Ack number"

| Property | Value |
|----------|-------|
| Solution ID | sk169984 |
| Date Created | 2020-10-14 |
| Last Modified | 2020-10-19 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- * Download of a file larger than 2GB is stopped after downloading 2GB of the file.
* The output of `fw ctl zdebug + drop` is:   
  dropped by fwmultik_process_f2p_cookie_inner Reason: PSL Drop: TCP off-path sequence inference. Dropping packet with old Ack number
* SmartConsole logs are "Accept" for the traffic.

## Cause

**PSL Mechanism General Explanation:**   

Packets may arrive out of order or may be legitimate retransmissions of packets that have not yet received an acknowledgment. In some cases a retransmission may also be a deliberate attempt to evade IPS detection by sending the malicious payload in the retransmission. The Security Gateway ensures that only valid packets are allowed to proceed to destinations. It does this with Passive Streaming Library (PSL) technology.  

* PSL is an infrastructure layer that provides stream reassembly for TCP connections.
* The gateway makes sure that TCP data seen by the destination system is the same as that seen by code above PSL.
* This layer handles packet reordering, congestion handling and is responsible for various security aspects of the TCP layer, such as handling payload overlaps, some DoS attacks and others.
* The PSL layer is capable of receiving packets from the firewall chain and from the SecureXL module.
* The PSL layer serves as a middleman between the various security applications and the network packets. It provides the applications with a coherent stream of data to work with, free of various network problems or attacks.
* The PSL infrastructure is wrapped with well defined APIs called the Unified Streaming APIs which are used by the applications to register and access streamed data

<br />

**The traffic is being dropped due to core-protection "TCP Off-Path Sequence Inference"**   

The default action for this protection is "Inactive". On environments in which this issue exists, the protection's action has been changed to "Drop"

<br />

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content