> Source: [sk185090](https://support.checkpoint.com/results/sk/sk185090)

# sk185090 - Security Gateway configured as a DHCP server stops responding after packet capture

| Property | Value |
|----------|-------|
| Solution ID | sk185090 |
| Date Created | 2026-06-27 |
| Last Modified | 2026-07-02 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |
| Platform | 3000, 7000, 28000, 9000, Open Server, 3900, 16000, 26000, 19000, 29000, 6000 |

## Symptoms

- * DHCP clients stop receiving Internet Protocol (IP) addresses from the DHCP server on the Security Gateway.
* DHCP clients continue to send DHCP Discover and DHCP Renew requests. The Security Gateway does not send DHCP Offer responses.
* Packet captures show that DHCP client traffic reaches the Security Gateway, but the DHCP server does not reply.
* Packet captures show packets from 0.0.0.0:68 to 255.255.255.255:67. There is no matching DHCP Offer response from the Security Gateway.

## Cause

The Security Gateway handles DHCP packets incorrectly after you run `tcpdump` or `cppcap`.  

When a packet capture starts, the capture process connects to the Data Plane Development Kit (DPDK) receive (RX) queue. This action changes the packet delivery state. As a result, DHCP Discover and DHCP Renew packets get a packet mark. This packet mark causes the Security Gateway kernel path to drop the packets before they reach the DHCP server process.  

A kernel debug (`fw ctl zdebug + drop`) shows this sequence:

1. The DHCP packet reaches the Security Gateway.
2. The `packet_rcv_common` function drops the packet with this packet mark: `packet_mark=0x80002`.

Because the Security Gateway drops the DHCP Discover and DHCP Renew packets before the DHCP server can process them, the Security Gateway does not generate DHCP Offer responses.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content