> Source: [sk177030](https://support.checkpoint.com/results/sk/sk177030)

# sk177030 - Service delay on load sharing bond interface, uneven traffic distribution

| Property | Value |
|----------|-------|
| Solution ID | sk177030 |
| Date Created | 2021-12-23 |
| Last Modified | 2022-01-02 |
| Technical Level | Advanced |
| Products | Security Management Server |
| Versions | R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * In a load sharing bond interface in XOR mode or in 8023AD mode configured on Layer 2, there is a service delay.
* The volume of traffic that passes over the interface is higher than the link speed of the interface. Example: 1.5 Gbps of traffic passes over a 1Gbps interface.
* One interface receives most or all of the traffic.

## Cause

A load sharing bond interface in XOR mode can be configured to assign traffic based on Layer 2 information (XOR of hardware MAC addresses), or on Layer 3+4 information (IP addresses and Ports).   

When load sharing is configured on Layer 2, most or all traffic passes to the same destination MAC address (the Security Gateway). In most environments, the source MAC address is also the same for all traffic. As a result, the hash function chooses the same interface to handle all traffic.  

**Example Scenario:**   

The configuration below shows a very uneven TX (transmit) distribution on the two interfaces in the bond. The *eth2-01* interface handles almost all the transmitting operations. This is because x*mit-hash-policy-layer2* is configured in an environment with very few MAC addresses seen.  

Output of the Gaia Clish command `> show bonding group 0` on the Security Management Server/Multi-Domain Management Server:  

```
Bond Configuration

xmit-hash-policy layer2

down-delay 200

primary Not configured

lacp-rate slow

mode 8023AD

up-delay 200

mii-interval 100

Bond Interfaces

eth2-01
```

<br />

eth3-01  

Output of the Gaia Clish command `# while true;do netstat -ni | egrep eth[2,3]-01;echo;sleep 1;done` (traffic over the eth2 and eth3 interfaces in bold):  

```
eth2-01 1500 0 413503824 0 84 0 598843085 0 0 0 BMsRU

eth3-01 1500 0 405877929 0 153 0 516310 0 0 0 BMsRU

eth2-01 1500 0 413542412 0 84 0 598900418 0 0 0 BMsRU

eth3-01 1500 0 405913052 0 153 0 516321 0 0 0 BMsRU

eth2-01 1500 0 413583476 0 84 0 598956904 0 0 0 BMsRU

eth3-01 1500 0 405948909 0 153 0 516332 0 0 0 BMsRU

eth2-01 1500 0 413629359 0 84 0 599011828 0 0 0 BMsRU

eth3-01 1500 0 405976350 0 153 0 516350 0 0 0 BMsRU

eth2-01 1500 0 413676316 0 84 0 599067589 0 0 0 BMsRU

eth3-01 1500 0 406005143 0 153 0 516361 0 0 0 BMsRU
```

<br />

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content