> Source: [sk181292](https://support.checkpoint.com/results/sk/sk181292)

# sk181292 - Only one of the two subordinate interfaces handles most of the traffic in 802.3ad Bond with Transmit Hash Policy "Layer 3+4"

| Property | Value |
|----------|-------|
| Solution ID | sk181292 |
| Date Created | 2023-09-06 |
| Last Modified | 2025-01-20 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * One of the two subordinate interfaces in an 802.3ad Bond handles most of the outgoing traffic, although the transmit hash policy is set to "Layer 3+4".

  Example from CPView:

  ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk181292/bond_traffic202307221650391.png)
* The output of the "`grep 'Aggregator ID' /proc/net/bonding/bond<X>`" command shows that the two subordinate interfaces have the same Aggregator ID.

## Cause

The Bond transmit hash policy Layer3+4 policy uses the XOR of the traffic source and destination ports and IP addresses to select the subordinate interfaces for transmitting the traffic.

For fragmented TCP or UDP packets, and all other IP protocol traffic, the traffic source and destination port information is omitted.

Traffic capture on the subordinate interface which handles the most outgoing traffic shows:

1. The traffic is some kind of an IP Protocol called "**EtherIP: Tunneling Ethernet Frames in IP Datagrams**" (the Protocol Number is 97).
2. The traffic is sent from one source IP address to two different destination IP addresses.  
   Meaning, the transmit hash policy selects only this subordinate interface in the Bond for the two connections.

As a result, the traffic is not balanced between the two subordinate interfaces.

Example from Wireshark:

![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk181292/EtherIP202307221651172.png)

## Solution

This is not an issue on a Check Point Security Gateway.

The transmit hash policy Layer 3+4 is working as expected.

**A possible workaround** for this specific scenario (one source IP address and two different destination IP addresses):

Change one destination IP address by adding one to the last octet of the IP address (for example, from 192.168.1.99 to 192.168.1.100). As a result, the transmit hash policy should select a different subordinate interface in the Bond.

**Related Articles:**

* [sk111823 - Only one of the two subordinate interfaces handles most of the traffic in 802.3ad Bond with Transmit Hash Policy "Layer 2"](https://support.checkpoint.com/results/sk/sk111823)
* [Red Hat - Why are all interfaces not used in bonding Mode 2 or Mode 4?](https://access.redhat.com/solutions/666853)
* [Red Hat - How are the values for different policies in "xmit_hash_policy" bonding parameter calculated?](https://access.redhat.com/solutions/71883)

<br />

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content