https://community.checkpoint.com/t5/Scripts/Top-connections-script/m-p/268638#M1393 <P>This script outputs top 100 connections going through the firewall. I also tested it on one of clients' machines and was accurate. Below is example from my lab fw:</P> <P><BR />[Expert@CP-GW:0]# ./top_active_connections.sh<BR />=== Top 100 active src-&gt;dst connections (count) [MODE=translated] ===<BR />1 8.8.8.8 172.16.10.249 udp 53 58134<BR />1 8.8.8.8 172.16.10.249 udp 53 28748<BR />1 8.8.4.4 172.16.10.249 udp 53 36331<BR />1 8.8.4.4 172.16.10.249 tcp 53 15181<BR />1 213.186.33.3 172.16.10.249 tcp 80 10000<BR />1 2.16.170.175 172.16.10.249 tcp 80 10001<BR />1 2.16.170.175 172.16.10.249 tcp 80 10000<BR />1 18.67.39.18 172.16.10.249 tcp 443 10000<BR />1 172.16.10.252 172.16.10.249 tcp 52779 18192<BR />1 172.16.10.252 172.16.10.249 tcp 51373 18192<BR />1 172.16.10.252 172.16.10.249 tcp 257 60243<BR />1 172.16.10.252 172.16.10.249 tcp 257 46513<BR />1 172.16.10.252 172.16.10.249 tcp 257 37583<BR />1 172.16.10.249 8.8.8.8 udp 62528 53<BR />1 172.16.10.249 8.8.8.8 udp 33198 53<BR />1 172.16.10.249 8.8.4.4 udp 35754 53<BR />1 172.16.10.249 8.8.4.4 tcp 38070 53<BR />1 172.16.10.249 213.186.33.3 tcp 62720 80<BR />1 172.16.10.249 2.16.170.175 tcp 47004 80<BR />1 172.16.10.249 2.16.170.175 tcp 47000 80<BR />1 172.16.10.249 18.67.39.18 tcp 61298 443<BR />1 172.16.10.249 172.16.10.252 tcp 60243 257<BR />1 172.16.10.249 172.16.10.252 tcp 46513 257<BR />1 172.16.10.249 172.16.10.252 tcp 37583 257<BR />1 172.16.10.249 172.16.10.252 tcp 18192 52779<BR />1 172.16.10.249 172.16.10.252 tcp 18192 51373<BR />1 172.16.10.249 100.65.16.4 tcp 22 55221<BR />1 172.16.10.249 100.65.16.4 tcp 22 54898<BR />1 172.16.10.249 1.1.1.1 udp 64128 53<BR />1 172.16.10.249 1.1.1.1 tcp 51706 53<BR />1 172.16.10.231 224.0.0.18 vrrp 0 0<BR />1 100.65.16.4 172.16.10.249 tcp 55221 22<BR />1 100.65.16.4 172.16.10.249 tcp 54898 22<BR />1 1.1.1.1 172.16.10.249 udp 53 12250<BR />1 1.1.1.1 172.16.10.249 tcp 53 16131</P> <P>=== Top 100 active sources (count) [MODE=translated] ===<BR />17 172.16.10.249<BR />5 172.16.10.252<BR />2 8.8.8.8<BR />2 8.8.4.4<BR />2 2.16.170.175<BR />2 100.65.16.4<BR />2 1.1.1.1<BR />1 213.186.33.3<BR />1 18.67.39.18<BR />1 172.16.10.231</P> <P>=== Top 100 active destinations (count) [MODE=translated] ===<BR />17 172.16.10.249<BR />5 172.16.10.252<BR />2 8.8.8.8<BR />2 8.8.4.4<BR />2 2.16.170.175<BR />2 100.65.16.4<BR />2 1.1.1.1<BR />1 224.0.0.18<BR />1 213.186.33.3<BR />1 18.67.39.18<BR />[Expert@CP-GW:0]#</P> Mon, 13 Jul 2026 12:48:27 GMT the_rock 2026-07-13T12:48:27Z https://community.checkpoint.com/t5/Scripts/Top-connections-script/m-p/268638#M1393 11 Mon, 13 Jul 2026 12:48:27 GMT https://community.checkpoint.com/t5/Scripts/Top-connections-script/m-p/268638#M1393 the_rock 2026-07-13T12:48:27Z