During the Check Point Stateful Inspection Process, for packets that do not pass Firewall Kernel Inspection and are rejected by the rule definition, packets are:

This choice incorrectly omits logging - a Drop rule with tracking configured does generate log entries, so packets are not dropped without any record.

Dropping without both logs and a negative acknowledgment describes a fully silent drop with no tracking, which is not the standard behavior of a logged Drop rule applied during Firewall Kernel Inspection.

Sending a negative acknowledgment such as a TCP RST or ICMP Unreachable is the behavior specific to the Reject action, not to the Drop action described in this stateful inspection context.

When the Check Point Firewall Kernel applies a Drop rule during Stateful Inspection, the packet is silently discarded and a log entry is generated per the rule's tracking settings. No TCP Reset or ICMP Unreachable message is returned to the originating host - this silent discard with logging is the defining behavior of the Drop action, distinguishing it from the Reject action which does send a negative acknowledgment.