> Source: [sk183847](https://support.checkpoint.com/results/sk/sk183847)

# sk183847 - RX-ERR and RX-DRP Counters on Bonded Ports

| Property | Value |
|----------|-------|
| Solution ID | sk183847 |
| Date Created | 2025-09-03 |
| Last Modified | 2025-09-03 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81.20 |

## Symptoms

- * Security Gateway High Availability (HA) pairs report increasing RX-DRP (receive drops) and RX-ERR (receive errors) on bonded port members.
* Multiple bond ports (bond0, bond1, bond2) and their member ports show persistent RX drops and errors.
* The issue is visible in Health Check Point (HCP) and PRO reports, but does not cause immediate traffic impact
* After changing SecureXL from User Mode (UPPAK) to Kernel Mode (KPPAK), RX-DRP counters stop increasing, but RX-ERR counters begin to rise
* RX-ERR increases correlate with the rx_csum_bad.nic counter in ethtool output, indicating checksum errors.
* No physical errors or Cyclic Redundancy Check (CRC) issues are observed on the connected routers or switches; only queue drops are present.
* The issue persists after increasing the RX ring buffer size to 4096 and TX ring buffer size to 1024 on the affected ports. Example command output: ethtool -S eth1-03 \| grep rx_csum_bad rx_csum_bad.nic: 12345

## Cause

The underlying cause is hardware checksum offloading on Intel 700/800-series Network Interface Cards (NICs) using i40e/ice drivers in the Quantum Security Gateway. When SecureXL is switched from User Mode (UPPAK) to Kernel Mode (KPPAK), RX-DRP counters stop, but RX-ERR counters---specifically the rx_csum_bad.nic value---increase. This counter indicates that the NIC hardware detects Layer 3 or Layer 4 checksum errors in received packets. These errors are not caused by the Quantum Security Gateway itself, but typically result from issues with packets sent from the peer device or network path, such as incorrect checksum calculation or offloading settings on the sender. Intel and Red Hat document this as a hardware feature of these NICs. If traffic is unaffected, these errors are informational.

## Solution

1. Switch SecureXL to Kernel Mode (KPPAK):
   * Change SecureXL from User Mode (UPPAK) to Kernel Mode (KPPAK) on all cluster members to stop RX-DRP increases.
2. Increase Ring Buffer Sizes:
   * Set the RX ring buffer size to 4096 and the TX ring buffer size to 1024 on the affected ports (eth1-01, eth1-02, eth1-03) to optimize packet handling and reduce drops.
   * Example command:
     * ethtool -G eth1-03 rx 4096 tx 1024
3. Check Peer Device Settings:
   * Advise the customer to check the peer device (router or upstream network) for checksum offload settings or packet integrity issues.
4. No Further Action Required:
   * If traffic is unaffected, no further action is required on the Quantum Security Gateway side, as these errors are informational.   

     <br />

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content