> Source: [sk97666](https://support.checkpoint.com/results/sk/sk97666)

# sk97666 - Kernel debug shows that traffic is "dropped by fwchain_frag Reason: wait for more fragments"

| Property | Value |
|----------|-------|
| Solution ID | sk97666 |
| Date Created | 2013-12-11 |
| Last Modified | 2020-01-27 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- When running a kernel debug "`fw ctl debug -m fw + drop`" on the Security Gateway, messages about fragmentation are seen.  
Example:  
"`dropped by fwchain_frag Reason: wait for more fragments`"

## Cause

Message "*fwchain_frag Reason: wait for more fragments*" does not necessarily indicate any sort of a problem. By itself, a drop for this reason simply means the Security Gateway is handling a fragmented packet.

Whenever a fragment arrives to the Security Gateway, it buffers (holds) the packet in its memory. After the fragment has been held in memory, Security Gateway drops the fragment being processed by the kernel with reason: "*fwchain_frag Reason: wait for more fragments* ".  
It does this for each fragment until the last piece (fragment) of the packet is received.

Once Security Gateway has all fragments of the packet, it virtually re-assembles the full packet, then sends it back through the kernel inspection engine as a whole packet to be inspected.

Once inspection is complete the original fragments are forwarded as normal through the egress interface of the firewall.

If, for some reason, all the fragments of the packet were not received in time (1 second by default), then you will see another drop log: "*held chain expired*". At this point, the fragments that were previously held in memory are discarded.

If you do not ever see drops for "*held chain expired* ", but only see "*fwchain_frag Reason: wait for more fragments*", then nothing is being dropped/blocked by the Security Gateway. It simply performs virtual fragmentation reassembly.

If you see "*fwchain_frag Reason: wait for more fragments* " followed by "*held chain expired*", then most likely, you are not receiving all the required fragments. This traffic is failing.

**Related solution:** [sk44711 - Kernel debug shows that TCP traffic is "dropped by fwhold_expires Reason: held chain expired"](http://supportcontent.checkpoint.com/solutions?id=sk44711).

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content