https Traffic Dropped ... due to Out of sequence TCP packet retransmission. Stripping all packet dat

[Don_Paterson]

Trying to understand what the exact cause/s for this PSL drop might be.

Anyone else seen it and found out more?

Log image attached. SK reference image attached.

"https Traffic Dropped from ... to ... due to Out of sequence TCP packet retransmission. Stripping all packet data. Please refer to sk172266."

[the_rock]

I had this issue with customers couple times and below is what we did to fix it. Not saying it would work for you, but thats what did work in our case. Just need to put in affected IPs/subnets in both src/dst

Andy

 

[Don_Paterson]

Nice. Thanks!

I'm looking at SK122072 
https://support.checkpoint.com/results/sk/sk122072

"

Solution
These logs can be safely ignored and disabled by setting the following kernel parameter:

# fw ctl set int psl_disable_keepalive_logs 1

"

But also thinking about MTUs, ring buffer sizes and also elephant flow (Hyperflow).
https://support.checkpoint.com/results/sk/sk42181

EDIT:

+ This is about image files being transferred over the network.

[the_rock]

Well, here is my logic about this, and not only this, but really any traffic problem...so IF those logs are indication of the actual issue, then it needs to be addresses. However, if you see them, but you are simply curious why they are there (but no any other problems), then those SKs would make sense.

Also, all tcp out of state means, in most simple terms, is this...communication is broken somewhere, along the way...3-way handshake is not happening properly.

Andy

[Don_Paterson]

ACK. Agree.

Did you confuse Out of Sequence with Out of State? 😉

[the_rock]

I did, sorry lol. Did not get much sleep, had Fortigate cutover at 4.30 am, so my apologies.

[the_rock]

But here is bigger question...is there an ACTUAL traffic issue, or are you simply concerned about the logs you see?

Andy