> Source: [sk43772](https://support.checkpoint.com/results/sk/sk43772)

# sk43772 - 'kernel: neighbor table overflow' appears repeatedly in /var/log/messages files

| Property | Value |
|----------|-------|
| Solution ID | sk43772 |
| Date Created | 2010-01-04 |
| Last Modified | 2025-11-26 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- '`kernel: neighbour table overflow`' message appears repeatedly in `/var/log/messages` files.

## Cause

ARP cache table is overflowing.

Most likely reason - too much traffic on the network (generated by some application, by some hosts, or by related factors).

## Solution

**Table of Contents:**

* Background
* Explanation
* Action plan
* Instructions

### Background {#Background}

The problem is not related to Check Point products, but to the Linux OS.

The solution to the problem is to increase the threshold levels for the ARP cache table.

**Note:** If you have additional questions about the ARP cache mechanism and its thresholds, then refer to articles and books available on the Internet.

### Explanation {#Explanation}

This section provides a basic explanation about the relevant Linux Kernel parameters.

* The relevant three parameters are defined in the Linux Kernel Code in the header file */include/net/neighbour.h* as **integer**.

* Starting in the Gaia R80.30 version, Gaia Portal accepts maximal value of 131072. In lower versions that value was 16384.

* ***gc_thresh1***

  The minimum number of entries to keep in the ARP cache.  
  The garbage collector will not run if there are fewer than this number of entries in the cache. **Note:** In Linux kernel 2.6.18, this value was ignored, meaning the garbage collector would activate regardless of the number of entries in the cache.

<!-- -->

* ***gc_thresh2***

  The soft maximum number of entries to keep in the ARP cache.   
  The garbage collector will allow the number of entries to exceed this threshold for 5 seconds before garbage collection will be performed.
* ***gc_thresh3***

  The hard maximum number of entries to keep in the ARP cache.   
  The garbage collector will always run if there are more than this number of entries in the cache.

  In order for the garbage collector to work properly, and not to overload the machine with garbage collections, when changing the *gc_thresh3* parameter, users *should* (note: do *not* have to) change the values of the *gc_thresh2* and *gc_thresh1* parameters accordingly.

### Action plan {#ActionPlan}

Follow these guidelines:

1. Find the threshold levels, at which the error messages about "*neighbour table overflow*" does not appear anymore.

2. Configure the new threshold levels permanently.

3. Check with the "*arp -an* " command if ARP table on Security Gateway / Cluster member contains multiple entries with the MAC address of your ISP device.  
   In such case, consider changing the default route from "*route through interface (external, leading to ISP)* " to "*route through next hop IP address (of ISP device)* ".  
   For configuration instructions, refer to the [Gaia Administration Guide](https://support.checkpoint.com/product/73#f[commonsource]=C.%20Documentation) for your version.

### Instructions {#Instructions}

Gaia Portal / Gaia Clish will override any settings placed in the */etc/sysctl.conf* file. Any changes made in this file do *not* take effect after a reboot.

To configure the threshold level for ARP cache in Gaia OS, use one of these methods:

* In Gaia Portal:

  Go to ***Network Management*** section - click on ***ARP*** page - go to section ***ARP Table Settings*** section - enter the desired value in ***Maximum Entries*** field.
* In Gaia Clish:

  ***HostName\> set arp table cache-size \<Number_of_Entries\>***   
  ***HostName\> save config***

To check the current threshold level for ARP cache in Gaia OS, run one of these commands:

* In Gaia Clish:

  ***HostName\> show arp table cache-size***
* In the Expert mode:

  ***\[Expert@HostName:0\]# dbget ip:arp:cache_size***

Notes:

* Starting from the R80.30 version, Gaia OS accepts maximal value of 131072. In lower versions that value was 16384.

* After the above configuration steps, the settings will survive a reboot.

* Settings are applies immediately (reboot, restart of any services, policy installation are *not* required).

* The *Maximum Entries* value in the Gaia Portal corresponds to the ***gc_thresh3*** parameter in the Linux kernel.

  **Note:** In Gaia OS, the value of ***gc_thresh1*** and the value of ***gc_thresh2*** are automatically determined by the value of ***gc_thresh3***:
  * (gc_thresh1) = (gc_thresh3) / 8
  * (gc_thresh2) = (gc_thresh3) / 2

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content