topic Re: find trafic in 750 appliance in Firewall and Security Management

find trafic in 750 appliance

hezi_angel — Fri, 18 Jan 2019 06:27:54 GMT

hello

I have 750 appliance And I want to find who takes me the most bandwidth.

In: Active computers - Start Traffic Monitoring

I see the traffic of all computers since the firewall is turned on

Is there another way to find bandwidth usage now?

I tried downloading a packet in: Tools - Paket Capture

I went in to save the packets, but it only keeps 500kb, which is less than a second of traffic

Is it possible to save all the network's traffic for more time?

Thank you

Re: find trafic in 750 appliance

PhoneBoy — Fri, 18 Jan 2019 19:25:02 GMT

There is limited storage space on the 750, which is why the packet capture limit is so small.

You could probably save more to a USB drive from expert mode using the tcpdump command.

Re: find trafic in 750 appliance

PhoneBoy — Fri, 18 Jan 2019 21:45:51 GMT

You can definitely see who is using large amounts of bandwidth in the last hour, though.

This requires using Identity Awareness.

Re: find trafic in 750 appliance

hezi_angel — Sat, 19 Jan 2019 17:22:06 GMT

How to use tcpdump?

Is this a computer connected to one of the lan?

Through tcpdump you can also check the speed of traffic?
Or will I still need to use the wireshark with the file I'm creating?

Thanks

Re: find trafic in 750 appliance

hezi_angel — Sat, 19 Jan 2019 17:30:16 GMT

This only works if I set a user for each Ip

It does not show by ip or computer's name

In applications it is impossible to know which computer is using the specific software

For example, if I found that there is a big use of windows update

I can not tell which computer it is

Thanks

Re: find trafic in 750 appliance

PhoneBoy — Sat, 19 Jan 2019 18:20:55 GMT

If you're logging applications, you should be able to tell which computers are using Windows Update, though.

Re: find trafic in 750 appliance

PhoneBoy — Sat, 19 Jan 2019 18:22:47 GMT

tcpdump is a command you can run on the 750 via the CLI in expert mode.

It's a standard Unix command.

You would then download the pcap file and, if you prefer, look in Wireshark or any other offline tool.

The following might be helpful if you've never used tcpdump before:

[tool] - https://tcpdump101.com‌

Re: find trafic in 750 appliance

hezi_angel — Sat, 19 Jan 2019 20:07:31 GMT

I do this from any computer connected to the network

Or from a computer connected to a special place?

Thank you very much

It helps me a lot

Re: find trafic in 750 appliance

hezi_angel — Sat, 19 Jan 2019 20:10:20 GMT

in applications

He shows me only the software, not some computer

Could it be that he show me the computers only if i write the user on router?

Re: find trafic in 750 appliance

PhoneBoy — Sat, 19 Jan 2019 20:12:32 GMT

Like I said, you run the command from the CLI.

You do that either from an SSH session (can be from anywhere) or a Console connection, which requires a direct serial/USB connection to the appliance.

Re: find trafic in 750 appliance

hezi_angel — Sat, 19 Jan 2019 22:34:57 GMT

Sorry

I still did not understand

If I run tcpdump from one of the computers it will create me a traffic file just for this computer

So how do I connect the computer that it will receive all the traffic?

I did not understand how to run the cli via ssh, and then run the tcpdump

Can I explain this or a guide?

Thank you

Re: find trafic in 750 appliance

PhoneBoy — Sun, 20 Jan 2019 11:33:20 GMT

You should be able to look at the logs and find the people using those specific applications.

Re: find trafic in 750 appliance

PhoneBoy — Sun, 20 Jan 2019 11:46:52 GMT

You are trying to run tcpdump on the 750 appliance itself.

To do that, you need to reach the CLI of the device.

You can access the CLI using:

SSH (using a client like putty from a PC)
A USB/Serial connection to the device (putty can also use a serial connection).

Once you get there, you can run tcpdump with the appropriate options.

I highly recommend reviewing the product documentation: Check Point 700/900 Appliances R77.20.81 Administration Guide

You may also want to consult with someone from your local Check Point office or partner.