https://community.checkpoint.com/t5/Scripts/Zdebug-drop-script/m-p/268225#M1350 <P>This script does exact same thing as if you were to run the actual command itself, but, PLEASE be careful, because this one does generic debug, not grep for any IP address. dos2unix and chmod 777 required to run it. MAKE SURE to run fw ctl debug 0 afterwards to turn the debugs off.</P> <P>See the output from my lab fw:</P> <P><BR />[Expert@CP-GW:0]# ./cp_watch_drops.sh<BR />Defaulting all kernel debugging options, may take a while<BR />Debug state was reset to default.<BR />PPAK 0: Get before set operation succeeded of simple_debug_filter_off<BR />Initialized kernel debugging buffer to size 1023K<BR />Updated debug variable for module fw<BR />Kernel debugging buffer size: 1023KB<BR />HOST:<BR />Module: kiss<BR />Enabled Kernel debugging options: None</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: kissflow<BR />Enabled Kernel debugging options: error warning<BR />Messaging threshold set to type=Info freq=Common</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: fw<BR />Enabled Kernel debugging options: drop<BR />Messaging threshold set to type=Info freq=Common</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: h323<BR />Enabled Kernel debugging options: error<BR />Messaging threshold set to type=Info freq=Common</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: cpcode<BR />Enabled Kernel debugging options: error warning<BR />Messaging threshold set to type=Info freq=Common</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: upconv<BR />Enabled Kernel debugging options: error warning info<BR />Messaging threshold set to type=Info freq=Common</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: WS_SIP<BR />Enabled Kernel debugging options: None</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: crypto<BR />Enabled Kernel debugging options: error warning<BR />Messaging threshold set to type=Info freq=Common</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: multik<BR />Enabled Kernel debugging options: None</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: PSL<BR />Enabled Kernel debugging options: error warning<BR />Messaging threshold set to type=Info freq=Common</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: CPAS<BR />Enabled Kernel debugging options: error warning<BR />Messaging threshold set to type=Info freq=Common</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: UDP_IS<BR />Enabled Kernel debugging options: error warning<BR />Messaging threshold set to type=Info freq=Common</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: seqvalid<BR />Enabled Kernel debugging options: error warning<BR />Messaging threshold set to type=Info freq=Common</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: synatk<BR />Enabled Kernel debugging options: None</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: MUX<BR />Enabled Kernel debugging options: error warning<BR />Messaging threshold set to type=Info freq=Common</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: CPSSH<BR />Enabled Kernel debugging options: error warning<BR />Messaging threshold set to type=Info freq=Common</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: fg<BR />Enabled Kernel debugging options: error<BR />Messaging threshold set to type=Info freq=Common</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: UC<BR />Enabled Kernel debugging options: None</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: dlpk<BR />Enabled Kernel debugging options: None</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: dlpuk<BR />Enabled Kernel debugging options: None</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: SDWAN<BR />Enabled Kernel debugging options: error warning<BR />Messaging threshold set to type=Info freq=Common</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: cpconntim<BR />Enabled Kernel debugging options: error warning<BR />Messaging threshold set to type=Info freq=Common</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: gtp<BR />Enabled Kernel debugging options: None</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: VPN<BR />Enabled Kernel debugging options: err<BR />Messaging threshold set to type=Info freq=Common</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: WSIS<BR />Enabled Kernel debugging options: None</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: UPIS<BR />Enabled Kernel debugging options: None</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: cmi_loader<BR />Enabled Kernel debugging options: None</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: NRB<BR />Enabled Kernel debugging options: None</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: SGEN<BR />Enabled Kernel debugging options: None</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: RAD_KERNEL<BR />Enabled Kernel debugging options: None</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: WS<BR />Enabled Kernel debugging options: None</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: APPI<BR />Enabled Kernel debugging options: None</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: UP<BR />Enabled Kernel debugging options: None</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: MALWARE<BR />Enabled Kernel debugging options: None</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: UCA<BR />Enabled Kernel debugging options: None</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: CI<BR />Enabled Kernel debugging options: None</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: SFT<BR />Enabled Kernel debugging options: None</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: ICAP_CLIENT<BR />Enabled Kernel debugging options: None</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: FILEAPP<BR />Enabled Kernel debugging options: None</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: dlpda<BR />Enabled Kernel debugging options: None</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: FILE_SECURITY<BR />Enabled Kernel debugging options: None</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: TPUTILS<BR />Enabled Kernel debugging options: None</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: ZPH<BR />Enabled Kernel debugging options: None</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: DOMO<BR />Enabled Kernel debugging options: None</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: SDWANRB<BR />Enabled Kernel debugging options: None</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: IDAPI<BR />Enabled Kernel debugging options: None</P> <P>-----------------------------------------------------<BR />HOST:<BR />Module: RTM<BR />Enabled Kernel debugging options: err<BR />Messaging threshold set to type=Info freq=Common</P> <P>-----------------------------------------------------<BR />SecureXL Debug Flags</P> <P>Module: default (0)</P> <P><BR />Module: db (0)</P> <P><BR />Module: api (0)</P> <P><BR />Module: pkt (0)</P> <P><BR />Module: infras (0)</P> <P><BR />Module: tmpl (0)</P> <P><BR />Module: vpn (0)</P> <P><BR />Module: nac (0)</P> <P><BR />Module: cpaq (0)</P> <P><BR />Module: synatk (0)</P> <P><BR />Module: adp (0)</P> <P><BR />Module: dos (0)</P> <P><BR />Module: gtp (0)</P> <P><BR />Module: sdwan (0)</P> <P><BR />Module: usdisp (0)</P> <P><BR />Module: exl (0)</P> <P><BR />Module: dpdk_lib (0)</P> <P><BR />Module: dpdk_pmd (0)</P> <P><BR />Module: dpdk_other (0)</P> <P>-----------------------------------------------------<BR />VPN Simple Debug Filter Not Activated<BR />-----------------------------------------------------<BR />Simple Debug Filter Not Activated<BR />-----------------------------------------------------<BR />@;0.0;kiss_debug_report: start<BR />@;0.0;kiss_debug_report: start<BR />@;0.0;kiss_debug_report: start<BR />@;0.0;kiss_debug_report: start<BR />@;0.0;kiss_debug_report: start<BR />@;0.0;kiss_debug_report: start<BR />@;0.0;kiss_debug_report: start<BR />@;0.0;kiss_debug_report: start<BR />@;0.0;kiss_debug_report: start<BR />@;0.0;kiss_debug_report: start<BR />@;0.0;kiss_debug_report: start<BR />@;0.0;kiss_debug_report: start<BR />@;0.0;kiss_debug_report: start<BR />@;0.0;kiss_debug_report: start<BR />@;0.0;kiss_debug_report: start<BR />@;1.0;kiss_debug_report: start<BR />@;1.0;kiss_debug_report: start<BR />@;1.0;kiss_debug_report: start<BR />@;1.0;kiss_debug_report: start<BR />@;1.0;kiss_debug_report: start<BR />@;1.0;kiss_debug_report: start<BR />@;1.0;kiss_debug_report: start<BR />@;1.0;kiss_debug_report: start<BR />@;1.0;kiss_debug_report: start<BR />@;1.0;kiss_debug_report: start<BR />@;1.0;kiss_debug_report: start<BR />@;1.0;kiss_debug_report: start<BR />@;1.0;kiss_debug_report: start<BR />@;1.0;kiss_debug_report: start<BR />@;1.0;kiss_debug_report: start<BR />@;1.0;kiss_debug_report: start</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>^C<BR />Next time perform for exit: "fw ctl debug 0"</P> <P>Defaulting all kernel debugging options, may take a while<BR />Debug state was reset to default.<BR />PPAK 0: Get before set operation succeeded of simple_debug_filter_off<BR />[Expert@CP-GW:0]#<BR />[Expert@CP-GW:0]#<BR />[Expert@CP-GW:0]#<BR />[Expert@CP-GW:0]#<BR />[Expert@CP-GW:0]#<BR />[Expert@CP-GW:0]#<BR />[Expert@CP-GW:0]#<BR />[Expert@CP-GW:0]#<BR />[Expert@CP-GW:0]# fw ctl debug 0<BR />Defaulting all kernel debugging options, may take a while<BR />Debug state was reset to default.<BR />PPAK 0: Get before set operation succeeded of simple_debug_filter_off<BR />[Expert@CP-GW:0]#</P> Fri, 10 Jul 2026 08:35:48 GMT the_rock 2026-07-10T08:35:48Z https://community.checkpoint.com/t5/Scripts/Zdebug-drop-script/m-p/268225#M1350 12 Fri, 10 Jul 2026 08:35:48 GMT https://community.checkpoint.com/t5/Scripts/Zdebug-drop-script/m-p/268225#M1350 the_rock 2026-07-10T08:35:48Z https://community.checkpoint.com/t5/Scripts/Zdebug-drop-script/m-p/268482#M1380 <P>You may want to add a "+" to the command like this: fw ctl zdebug + drop.&nbsp; Without the +, drops that occur on the SND cores will not appear; only drops on the Firewall Workers (mainly from rules being hit with a Drop action) will appear. Drops almost always happen on the Firewall Worker cores.&nbsp; Packet drops in the Check Point SecureXL code on SND cores are rare but can occur when DoS protections, such as the SecureXL Penalty Box or Drop Templates, are configured.</P> Fri, 23 Jan 2026 20:49:46 GMT https://community.checkpoint.com/t5/Scripts/Zdebug-drop-script/m-p/268482#M1380 Timothy_Hall 2026-01-23T20:49:46Z https://community.checkpoint.com/t5/Scripts/Zdebug-drop-script/m-p/268483#M1381 <P>Thanks Tim.</P> Fri, 23 Jan 2026 20:51:00 GMT https://community.checkpoint.com/t5/Scripts/Zdebug-drop-script/m-p/268483#M1381 the_rock 2026-01-23T20:51:00Z