topic Re: ECONN - Easy Connection Table Tool in Scripts

ECONN - Easy Connection Table Tool v6.9

HeikoAnkenbrand — Tue, 27 Jan 2026 23:43:23 GMT

This econn tool version 6.9 is a command-line utility for analyzing active firewall connection tables, specifically from Check Point firewalls via the fw tab -t connections -u command. It parses raw connection entries, resolves service names, maps interface IDs to names, and provides powerful filtering options based on IP addresses, ports, protocols, rules, networks, and interface names. Results can be displayed in a structured table, and optional statistics can be generated.

One of its greatest strengths lies in the powerful filtering options. With just a few parameters, the view can be narrowed down to specific source or destination addresses, certain ports, or even entire networks. Filtering by protocol or interface is also possible, allowing administrators to isolate exactly the connections that are relevant to their analysis within seconds.

Beyond simple presentation, econn delivers extensive statistical insights. It highlights which rules are most frequently used, which ports and IP combinations dominate, and how communication is distributed across different interfaces. This helps build a deeper understanding of network behavior and makes it easier to identify irregularities.

Ultimately, the tool provides a quick overview of all relevant communication relationships. Even in complex environments with many segments, traffic becomes more transparent as connections are logically grouped and summarized. For administrators, this means a significant simplification in evaluating communication flows and a valuable aid in day-to-day network operations.

The -stat option provides a general overview of the filtered connections. It summarizes key information such as which ports, rules, protocols, services, and interfaces are involved, giving administrators a quick snapshot of the traffic.

With -statip, the tool lists all unique source and destination IP addresses. This makes it easy to see at a glance which hosts are participating in the current connections.

The -statnet option focuses on networks rather than individual IPs. It groups communication into Class C (/24) and Class B (/16) networks, helping to understand traffic distribution across subnets.

Using -statconn, administrators can see all source–destination IP pairs along with the ports they are using. This highlights who is talking to whom and which services are being exchanged.

The -statport option organizes connections by destination port. For each port, it shows the related IP pairs without duplicates, making it clear which services are most active.

With -statrule, the output is grouped by firewall rule. It shows which source and destination pairs are affected by each rule and the ports they use, which is particularly useful for validating security policies.

Finally, -notab hides the detailed connection table. This is useful when the focus is only on statistics or summaries, reducing clutter in the output.

Install tool:

curl_cli -k https://www.checkpoint.tips/tools/econn > /usr/bin/econn && chmod 770 /usr/bin/econn && dos2unix /usr/bin/econn

Online help:

Usage: econn [filters] [options] Filter options (detailed): -s=<IP> Filter by source IP address -d=<IP> Filter by destination IP address -sp=<Port> Filter by source port -dp=<Port> Filter by destination port -n=<Name> Filter by service name (if available) -r=<Rule> Filter by rule number -p=<Protocol> Filter by protocol (e.g., TCP, UDP, ICMP) -net=<CIDR> Filter if either source or destination IP is in the network -snet=<CIDR> Filter if source IP is in the network -dnet=<CIDR> Filter if destination IP is in the network -si=<iface> Filter by inbound interface name -di=<iface> Filter by outbound interface name -g=<string> Grep-like search: only show rows containing the string Statistics / Output options: -stat Show general statistics for the current filter -statip Show all unique IP addresses (source & destination) -statnet Show all networks (Class C / B) involved in connections -statconn Show all IP pairs with their associated ports -statport Group output by ports (with IP pairs, no duplicates) -statrule Group output by rules (with IP pairs and ports) -notab Hide the main connection table from output General: --help Show this help message and exit Examples: econn -s=192.168.1.10 -p=TCP econn -dnet=10.0.0.0/8 -stat econn -g=established -p=TCP econn -sp=80 -statport econn -dp=443 -statconn econn -r=101 -statrule econn -net=192.168.0.0/16 -p=UDP -statip econn -g=FIN -stat -notab econn -d=8.8.8.8 -statrule -statport econn -si=eth0 -di=eth1 -p=TCP -statport -notab

Demo video:

(view in My Videos)

Re: ECONN - Easy Connection Table Tool

Danny — Tue, 19 Aug 2025 10:40:30 GMT

Thanks for sharing another econn update, while it’s getting a bit tricky to keep track of all the different threads.

Just to recap, we’ve got:

community thread for version 0.x is here
community thread for version 1.x is here
community thread for version 4.x is here
community thread for version 5.x is here
community thread for version 6.x is here

To make it easier for everyone to find and follow the latest version, it might be helpful to keep updates consolidated in a single thread. That way, folks can stay up to date and jump in more easily.

Re: ECONN - Easy Connection Table Tool

Machine_Head — Tue, 19 Aug 2025 12:53:40 GMT

Nice one - Thanks!

Re: ECONN - Easy Connection Table Tool

HeikoAnkenbrand — Tue, 19 Aug 2025 16:25:33 GMT

What's new in version 6.x:

I decided to create this new version to improve both usability and performance. The old implementation relied heavily on bash and regex, which I have now migrated to Python 3 for cleaner and more maintainable code.
- The evaluation of the rule set is now significantly faster — for example, processing
1 million connections takes only about 5 seconds.
- The new approach is much more resource-efficient and scalable, handling up to
10 million connections without issues.
- On top of that, I’ve expanded the statistics module with new features, including
sorting and grouping options, to make analysis more powerful and flexible:
-statconn -> Show all IP pairs with their associated ports

-statport -> Group output by ports (with IP pairs, no duplicates)

-statrule -> Group output by rules (with IP pairs and ports)

-statif -> Group output by interface (with IP pairs and ports)

Re: ECONN - Easy Connection Table Tool

otto_w — Tue, 19 Aug 2025 19:18:04 GMT

WOW - This tool is absolutely outstanding – it turns raw firewall connection data into clear, structured insights with powerful filtering and statistics, making troubleshooting faster, smarter, and more efficient.

Re: ECONN - Easy Connection Table Tool

Ingard — Wed, 20 Aug 2025 06:12:13 GMT

Hi @HeikoAnkenbrand,
Can the output be redirected to a file using a switch in the CLI?

Re: ECONN - Easy Connection Table Tool

HeikoAnkenbrand — Wed, 20 Aug 2025 16:05:23 GMT

Yes for example:

econn -net=192.168.0.0/16 -p=UDP -statrule > output_file.txt

Re: ECONN - Easy Connection Table Tool

Suvi — Thu, 21 Aug 2025 09:36:02 GMT

How can the tool be used to filter and analyze Check Point firewall connections, and can you provide an example of how its filtering or statistical features?

Re: ECONN - Easy Connection Table Tool

the_rock — Thu, 21 Aug 2025 11:59:44 GMT

Excellent!

Re: ECONN - Easy Connection Table Tool

HeikoAnkenbrand — Fri, 22 Aug 2025 07:23:27 GMT

The following command displays all outputs sorted by various criteria, such as rules, ports, and more. In addition, the connection table is presented in the following form:

The following command displays all outputs. You may only need to adjust the search filters if necessary.

econn -stat -statip -statnet -statconn -statport -statrule -snet=10.0.0.0/24 -r=10

Re: ECONN - Easy Connection Table Tool

the_rock — Fri, 22 Aug 2025 12:00:22 GMT

I did a bit if testing yesterday in the lab with this tool, I found it very useful. Amazing job, as always, @HeikoAnkenbrand

Andy

Re: ECONN - Easy Connection Table Tool

Lenhard — Sat, 23 Aug 2025 17:53:43 GMT

Hi @HeikoAnkenbrand ,
Great tool and excellent recommendation for evaluating the firewall connection.
We can test this together in our project next week.

Re: ECONN - Easy Connection Table Tool

the_rock — Mon, 25 Aug 2025 11:40:51 GMT

Excellent, indeed.

Re: ECONN - Easy Connection Table Tool

HeikoAnkenbrand — Tue, 26 Aug 2025 09:41:59 GMT

Thanks to netan for the private email.
I have fixed the bug with the interfaces. It should now work without any problems.

Re: ECONN - Easy Connection Table Tool

the_rock — Tue, 26 Aug 2025 14:06:27 GMT

Amazing tool, so helpful. Used it few times already, truly excellent.

Fantastic work, as always @HeikoAnkenbrand

Re: ECONN - Easy Connection Table Tool

HeikoAnkenbrand — Thu, 30 Oct 2025 22:15:08 GMT

I fixed two small errors in the code
and provided this short video:

(view in My Videos)

Re: ECONN - Easy Connection Table Tool

juergen_wollert — Thu, 30 Oct 2025 22:18:07 GMT

Very cool tool. THX

Re: ECONN - Easy Connection Table Tool

Dilian_Chernev — Mon, 10 Nov 2025 15:12:57 GMT

In version 4 there was a statistics about connection state:

Counter
TCP : 820
TCP SYN : 69
SYN-ACK : 0
ACK : 713
FIN : 38
UDP : 189
ICMP : 4
IGMP : 0
VRRP : 0
GRE : 0

Is there a way to get such in the actual verision ?

Thanks for the amazing tool!