topic Re: High RX Drops Observed in General Topics

High RX Drops Observed

RemoteUser — Tue, 08 Jul 2025 06:50:07 GMT

I’ve noticed a high number of RX drops on one of the interfaces.
Is it possible to reset these counters?
If so, how can I do that?

Re: High RX Drops Observed

Chris_Atkinson — Tue, 08 Jul 2025 09:31:45 GMT

I don't recall seeing any newer guidance on this.
For a cluster you can failover then perform:

ifdown ethX; ifup ethX

Re: High RX Drops Observed

Timothy_Hall — Tue, 08 Jul 2025 18:30:48 GMT

The technique Chris posted is the only way I know how. Note that it does technically cause an outage on the interface; however, if you execute the command as a single command with a semicolon, the outage is extremely brief. Not all RX-DRPs are loss of frames the firewall should have processed, some of them were probably "junk" frames the firewall can't process anyway. See sk166424: Number of RX packet drops on interfaces increases on a Security Gateway R80.30 and higher with Gaia kernel 3.10

Re: High RX Drops Observed

Lesley — Tue, 08 Jul 2025 19:34:27 GMT

Does HCP health check report also complain about the rx drops? are there any performance issues on the system?

What is the current value? ethtool -g eth1

Re: High RX Drops Observed

RemoteUser — Wed, 09 Jul 2025 07:04:57 GMT

Thank you, if i do set interface off and on, it's the same right?

Re: High RX Drops Observed

RemoteUser — Wed, 09 Jul 2025 07:06:23 GMT

yes, hcp report complain about rx drop, yes on the system the latency it's very solw

Re: High RX Drops Observed

_Val_ — Wed, 09 Jul 2025 07:42:58 GMT

You most probably have a receiving side issue on that interface that needs to be investigated and fixed. Resetting counters will not fix it, it can only mask the issue for a period of time.

Re: High RX Drops Observed

Johannes_Hoen — Wed, 09 Jul 2025 10:38:15 GMT

Can you check the interrupts on the interfaces ? I think the box is just overloaded....

Re: High RX Drops Observed

Lesley — Wed, 09 Jul 2025 12:51:47 GMT

Ok, share some details please. Check with cpview the errors and drops, make screenshot, check next day again. If they increase a lot share current buffer value.

clish

set interface Lan3 rx-ringsize 1024

save config

exit

ethtool -g Lan3

# ethtool -g Lan1

Ring parameters for Lan1:

Pre-set maximums:

RX: 4096

RX Mini: 0

RX Jumbo: 0

TX: 4096

Current hardware settings:

RX: 256

RX Mini: 0

RX Jumbo: 0

TX: 1024

Re: High RX Drops Observed

Timothy_Hall — Wed, 09 Jul 2025 13:29:33 GMT

Diagnosing RX-DRP issues became significantly more complicated in Gaia 3.10 when the counter's meaning changed. Here are the relevant pages from my Gateway Performance Optimization Course detailing how to assess whether or not you should do something about them:

Re: High RX Drops Observed

RemoteUser — Wed, 09 Jul 2025 14:15:31 GMT

the issue it solved by replacing the cable, now there is not any latency

Re: High RX Drops Observed

Timothy_Hall — Wed, 09 Jul 2025 14:21:37 GMT

Are you sure replacing the cable solved your RX-DRPs, not RX-ERR? A cable should not cause buffering misses (RX-DRP) unless the cable was the wrong type and linked up at a much slower speed than it should, which would actually be more likely to cause RX-OVR. Having a hard time accepting that replacing a cable fixed just RX-DRPs.

Re: High RX Drops Observed

RemoteUser — Wed, 09 Jul 2025 14:29:48 GMT

When the customer reported an issue with network connectivity, I checked the netstat -ni output and noticed the following:

RX-DRP: 34,137,237

RX-OK: 411,649,242

RX-ERR: Around 150, which I assume isn't significant.

and the ratio it's very high please see here:
https://community.checkpoint.com/t5/General-Topics/Ifconfig-dropped-explanation/td-p/24447

after we change the cable now seems everything works fine