- Products
- Learn
- Local User Groups
- Partners
- More
Maestro Masters Series 2026
WATCH NOWAfter rerouting a high PPS 100G traffic flow through a Maestro Security Group I observed increasing RX-DROPs on the active chassis backplane interfaces.
Investigation showed the drops were reported as rx_out_of_buffer while SND and worker cores remained largely idle. Based on the observed behavior, increasing the RX ring buffer was recommended as a mitigation for potential microburst-induced queue overflows.
[Global] FWSG-s01-01> show interface BPEth0 rx-ringsize
1_01:
Receive buffer ring size: 256
Maximum receive buffer ring size: 4096
# grep ringsize /config/active
# cat /proc/net/bonding/BPEth0 | grep eths
Slave Interface: ethsBP1-01
Slave Interface: ethsBP1-02
Slave Interface: ethsBP1-03
Slave Interface: ethsBP1-04
# ethtool -g ethsBP1-01
Ring parameters for ethsBP1-01:
Pre-set maximums:
RX: 8160
Current hardware settings:
RX: 1024# g_all -a "dbset interface:ethsBP1-01:rx-ringsize 4096"
# g_all -a "dbset interface:ethsBP1-02:rx-ringsize 4096"
# g_all -a "dbset interface:ethsBP1-03:rx-ringsize 4096"
# g_all -a "dbset interface:ethsBP1-04:rx-ringsize 4096"
# g_all -a "dbset :save"# grep ringsize /config/active
interface:ethsBP1-01:rx-ringsize 4096
interface:ethsBP1-02:rx-ringsize 4096
interface:ethsBP1-03:rx-ringsize 4096
interface:ethsBP1-04:rx-ringsize 4096
# ethtool -g ethsBP1-01
Ring parameters for ethsBP1-01:
Pre-set maximums:
RX: 8160
Current hardware settings:
RX: 4096[Global] FWSG-s01-01> show configuration interface
set interface ethsBP1-01 rx-ringsize 4096
set interface ethsBP1-02 rx-ringsize 4096
set interface ethsBP1-03 rx-ringsize 4096
set interface ethsBP1-04 rx-ringsize 4096
[Global] FWSG-s01-01> show interface BPEth0 rx-ringsize
1_01:
Receive buffer ring size:256
Maximum receive buffer ring size:4096grep ringsize /config/activeethtool -g continued to report RX = 4096 on the slave interfaces.rc.local as documented in sk183094.ethtool -g on the slave interfaces the authoritative validation method?rc.local still required on R82 Maestro?set interface ethsBP* rx-ringsize entries after a successful dbset operation, and are these intended to be valid Gaia configuration commands or merely a representation of the underlying database configuration? I'm asking because these commands are rejected when executed manually.---
@Lari_Luoma @Anatoly @Tom_Kendrick @Laszlo_Csosza @Jochen_Hoechner @Tom_Hartig @Timothy_Hall
Thanks for sharing, @Danny
I believe I need to first start with stating that not all Scalable Platforms are the same. When reviewing documentation and KB Solutions, care needs to be taken to determine if the information is specific for ElasticXL, Maestro, or Scalable Chassis. This is not always apparent at first glance, so be extra careful when applying information to Scalable Platforms. Specifically, within the Scalable Platform Admin guide, there is a section about how to make changes to BPEthX. This is within the Scalable Chassis section of the guide, and can only be applied to Scalable Chassis.
Something to note: on Maestro, BPEthX is a pseudo interface, whereas on a Scalable Chassis, BPEthX is a physical interface. This causes confusion in situations as described here.
The pseudo interfaces BPEthX within Maestro specifically represent the aggregation of multiple physical backplane interfaces. The actual packet processing and buffering happen on the physical interfaces—not on the pseudo interface itself. Pseudo interfaces like BPEth0 do not have their own hardware buffers. Even though you see the setting from clish, it does nothing to affect the traffic across the physical interfaces.
As you found out, using the ethtool -g or -G options provide errors when run against pseudo interfaces like BPEth0. This is supposed to prevent conflicts that could arise from trying to set or display buffer sizes on a logical interface that does not directly interact with hardware queues. Therefore, the changes need to be done on the underlying physical interfaces ethsBP* that are associated with the pseudo interface.
To change the buffer size for the underlying physical interfaces, the dbset command is the way to set it, along with the dbset :save command to save the changes for future boots - like the save config within clish. To see the setting, the ethtool -g command can be used on the physical interface, or the dbget command. Note: the dbget command will only show anything if it has previously been set manually.
These changes should be made in incremental changes, not immediately going to the largest value allowed. The ringsize can affect other things on the system, such as:
To answer your specific questions:
Hope this helps...
@CP_Chris : Thanks for your comprehensive answer and confirmation of my findings. I'm aware that changes to the RX buffer should be made in incremental steps. As each of such steps requires a maintenance window, those steps can't be too small (SG members will reboot = service degradation in production environment for several minutes).
Leaderboard
Epsum factorial non deposit quid pro quo hic escorol.
| User | Count |
|---|---|
| 17 | |
| 6 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 |
About CheckMates
Learn Check Point
Advanced Learning
YOU DESERVE THE BEST SECURITY