> Source: [sk184133](https://support.checkpoint.com/results/sk/sk184133)

# sk184133 - HTTP connections dropped after upgrade to R81.20 Jumbo Hotfix Take 99 and above

| Property | Value |
|----------|-------|
| Solution ID | sk184133 |
| Date Created | 2025-10-06 |
| Last Modified | 2025-11-23 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R81.20 |
| OS | Gaia |
| Platform | 7000 |

## Symptoms

- * After upgrading a Security Gateway from R81.10 Jumbo Hotfix Accumulator (JHF) Take 110 to R81.20 JHF Take 99 and above, multiple HTTP connections---especially on port 8080---are dropped at the kernel level.

* Firewall logs repeatedly show entries similar to:

  `
  fw_log_drop_ex: Packet proto=6 `:8080 -> : dropped by  
  fwmultik_process_f2p_cookie_inner Reason: PSL Drop: WS
* after enabling kernel debug + WS falg:
  Leftover bytes detected:
  6666505: \[SID: 51064639\] ws_http_session_send_header: left_header_len: 2
  6666506: \[SID: 51064639\] ws_http_session_send_header: adding the header end size: 2
  .

* The issue does not occur when traffic is added to fast_accel (bypassing deep inspection).

* Adding the correct Host header (including FQDN and port) does not resolve the drops.

* Packet captures and kernel debug show that Transmission Control Protocol (TCP) sessions are established, but application data is dropped.

## Cause

The client application sends HTTP POST requests with a Content-Length header that does not match the actual size of the payload. Specifically, the request declares Content-Length: 979 but transmits 981 bytes, due to an extra CRLF after the XML body.

Starting in R81.20 JHF Take 99, the Security Gateway enforces stricter compliance with [RFC 7230](https://datatracker.ietf.org/doc/html/rfc7230) (HTTP/1.1 Message Syntax and Routing). The parser interprets the extra bytes as the start of a new, malformed request and drops the connection for protocol violation.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content