Services Offload (SOF) (also known as Express Path) handling short-lived sessions, causing early exhaustion of NP memory.

SOF was incorrectly offloading short-lived flows leading to early exhaustion of NP memory.

After version 21.2R1, SRX4600, SRX5400, SRX5600 and SRX5800 will offload all the traffic if there are no plugins interested in the flow meaning that only the first packet will go to the SPU and the rest of the session packets will go to the NP for processing.

If Express Path (SOF) is offloading short lived flows this could lead to an early exhaustion of its memory, reducing overall device performance.

In order to avoid this scenario a policy can be created to explicitly disable SOF for certain traffic meaning that the subsequent packets of those sessions will still go to the SPU.

How to disable SOF for DNS traffic:

match {

source-address any;

destination-address any;

application junos-defaults;

dynamic-application junos:DNS;

}

then {

permit {

no-services-offload;

In order to monitor Network Processor (NP) cache consumption, offloaded sessions and capacity you can use the "show security np-cache summary" command.