topic Re: Fw monitor script in Scripts

Fw monitor script

the_rock — Wed, 25 Mar 2026 08:43:52 GMT

Re: Fw monitor script

the_rock — Fri, 23 Jan 2026 13:09:47 GMT

Basic capture I got from my lab fw...tested from 172.16.10.249 to quad 9 dns server

Re: Fw monitor script

Vincent_Bacher — Fri, 23 Jan 2026 13:26:43 GMT

Nice feature!
Two suggestions for improvement. If nothing is entered for src or dst, perhaps any should be used.

Pressing return results in an error.

And perhaps support for entering a network with a mask, e.g. 192.168.1.0/24.

Re: Fw monitor script

the_rock — Fri, 23 Jan 2026 13:30:14 GMT

Totally FAIR, Vince. I can definitely work on that.

Re: Fw monitor script

Vincent_Bacher — Fri, 23 Jan 2026 13:35:40 GMT

While you're at it, you can – as I do in the scripts – protect the user from themselves
so that they don't enter la.le.lu.li/24 or 10.10.10.0/200 or 300.0.0.1,
by checking whether it is even a valid address/network 🙂

Of course, one can assume that the user knows what they are doing, but I like error handling in scripts.

Re: Fw monitor script

the_rock — Fri, 23 Jan 2026 13:53:52 GMT

Again, totally fair.

Re: Fw monitor script

the_rock — Fri, 23 Jan 2026 23:07:48 GMT

I made tcpdump script that does any, will test it tomorrow in the lab.

Re: Fw monitor script

the_rock — Fri, 23 Jan 2026 23:15:21 GMT

Here you go brother : - )

@Vincent_Bacher

updated script, works with any. You can give it a go Monday.

Re: Fw monitor script

the_rock — Fri, 23 Jan 2026 23:17:12 GMT

Just updated the script to work with any as srs/dst:

lab:

[Expert@CP-GW:0]# cd /var/log/scripts/
[Expert@CP-GW:0]# chmod 777 *
[Expert@CP-GW:0]# dos2unix *
dos2unix: converting file cp_tcpdump.sh to Unix format ...
dos2unix: converting file fwmonitor.sh to Unix format ...
[Expert@CP-GW:0]# ./fwmonitor.sh
Source (IP/hostname/any) [any]:
Destination (IP/hostname/any) [any]:
Port (1-65535/any) [any]:
Protocol (tcp/udp/icmp/any or number) [any]:
Output mode: (1) screen only (2) text file (3) capture+decode files [1]: ^C
[Expert@CP-GW:0]#

Re: Fw monitor script

Vincent_Bacher — Mon, 26 Jan 2026 12:15:42 GMT

I'm really sorry, but this won't be possible this week. I've just come back from the doctor's, and I've been signed off work for a week, with more tests to come.

Re: Fw monitor script

the_rock — Mon, 26 Jan 2026 12:21:22 GMT

never be sorry for stuff like that mate...health ALWAYS first, ALWAYS. Be well and get healthy.