Create a Post
Showing results for 
Search instead for 
Did you mean: 

TCPdump active: performance increases and problem disappears


we have a very strange effect:

On a Check Point Appliance 23900 with VSX R80.30, we have trouble with a CIFS/SMBv2 (Server Message Block protocol) session through which multiple (concurrent?) transfers are being sent within a single TCP-445 connect.

While debugging, we noticed a strange effect: When we turn on tcpdump on the gateway within the VS environment on one interface (toward which the traffic is directed), two things happen:

  1. The performance of the throughput increased by about 50%
  2. Our problem disappears.

What does tcpdump on the gateway, that may lead to this behavior? By knowing that we would have a lead on the eoot cause of the problem.

Yours, Martin

P.S. The problem is that the concurrent transfer of five files fails. First we see (in a tcpdump on the client) a dramatic increase of the TCP ACK RTT (up to 40s) and after some time, the transfer is aborted. This is not necessarily a firewall problem, but it is strange that the problem does not occur when we run a tcpdump while testing.


  • SMBv2 is used
  • Effect does not depend on which interface it is run
  • Multi-queuing is active on the affected system
  • All relevant interfaces are bonds.
22 Replies
This widget could not be displayed.