topic Traffic Dropped and in logs rule name/number columns empty, I don't know why traffic was dropped. in General Topics

Traffic Dropped and in logs rule name/number columns empty, I don't know why traffic was dropped.

bkee9175 — Fri, 21 Apr 2023 10:12:15 GMT

I'm wondering if anyone can help me. I'm troubleshooting traffic that is being dropped. The access rule name/number is empty. In the past when I see this behaviour it was an indications of Asymmetrical traffic. To confirm this I could add TCP related columns which would confirm that the packets were dropped for not being the first in a TCP stream. In this case I am not seeing that.

Would anyone be able to recommend some troubleshooting I can perform to help ID what is causing the drops? Are there other columns I can add to logging to help understand the block reason?

Hardware is Checkpoint Appliance R80 Code

Re: Traffic Dropped and in logs rule name/number columns empty, I don't know why traffic was dropped

Chris_Atkinson — Fri, 21 Apr 2023 10:14:50 GMT

Can you please open one of the entries and provide a screenashot here with any sensitive detail removed?

Re: Traffic Dropped and in logs rule name/number columns empty, I don't know why traffic was dropped

bkee9175 — Fri, 21 Apr 2023 13:00:34 GMT

I didn't know you could click into each entry for more information. I'm pretty new to this GUI. It seems "address spoofing" is the reason, right? Looks like I have some more reading to do on how to assess this situation.

Re: Traffic Dropped and in logs rule name/number columns empty, I don't know why traffic was dropped

Chris_Atkinson — Fri, 21 Apr 2023 13:08:32 GMT

Correct. Address spoofing appears to be the cause here.

So the gateway is seeing traffic from a host it doesn't expect to see on this interface.

Depending on the specifics of your topology the potential non-malicious reasons could be due to routing or simply missing configuration where spoofing parameters are defined statically.

Re: Traffic Dropped and in logs rule name/number columns empty, I don't know why traffic was dropped

bkee9175 — Fri, 21 Apr 2023 13:07:47 GMT

Thank you Chris, very much appreciated. I will take a look at the network configuration and topology and see how everything is setup.

This article looks useful.
"Address spoofing" drop log (checkpoint.com)