> Source: [sk182582](https://support.checkpoint.com/results/sk/sk182582)

# sk182582 - Packets drop with "adp_nh_scheduler_queue_limit exceeded" error

| Property | Value |
|----------|-------|
| Solution ID | sk182582 |
| Date Created | 2024-08-12 |
| Last Modified | 2025-02-16 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R81.20, R81.10 (EOS) |
| OS | Gaia |

## Symptoms

- * Packets drop with `"adp_nh_scheduler_queue_limit exceeded"` error in the output of `"fw ctl zdebug + drop"`.

* ARP drops in "ipsctl net:dev:adp:nh:stats:arp_dropped"

## Cause

The "adp_nh_scheduler_queue_limit exceeded" error indicates many requests for next hop resolution, which fill the ARP-ADP module queue to its limit with next hop ARP not-resolved packets.  
This indicates an issue with layer 2 or routing the packets to their next hop rather than with the Security Gateway.

The ADP module queue getting filled up is directly related to the rate of inbound packets relying on (at least one of) those ARP entries that need resolution for the Security Gateway to forward the traffic but have the status of \<incomplete\>. This issue can occur, for example, if the next hop for these packets is not responding.

A simplified example of a packet flow scenario:

1. A packet comes into the Security Gateway, passes the rule base, and gets accepted (inbound complete).
2. Outbound processing starts, and the route is determined (the next hop that is directly connected or a router to forward to).
3. The packet goes to Performance Pack/SecureXL for delivery.
4. The next hop ARP is not resolved (note that in Linux, ARP is cyclic and gets stale, then refreshed, etc., to make sure it uses the most up-to-date next hop).
5. Performance Pack/SecureXL sends a message in a queue to the ADP module asking for resolution while it holds the packet.
6. ADP sends an ARP request and gets a reply from the next hop (in layer 2). The packet is dropped for unresolved next hop if the reply does not arrive until a timeout is reached.  
   If the queue in the ADP module for the next hop resolution is full, the Security Gateway immediately drops the traffic with the error "adp_nh_scheduler_queue_limit exceeded."

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content