topic Re: WireShark profile for `fw monitor` in Firewall and Security Management

WireShark profile for `fw monitor`

Hugo_vd_Kooij — Fri, 20 Oct 2017 07:16:37 GMT

I write a Wireshark profile to help you with reading `fw monitor` files.

I wrote a Dutch description on Wireshark Profiles and I guess the screenshots will be sufficient help to get you started for those not savvy in Dutch 😉

The Short English Version:

Create a Dummy personal profile (Name it whatever you like)
In WireShark, Goto Help => Folders and then proceed to your Personal Configuration directory
Put the ZIP file in the Profiles directory and unpack it.
Now you have your own Check Point profile that has coloring rules and some other smart things.

Feel free to mention any smart tricks with Wireshark you use the speed up reading `fw monitor` files.

Re: WireShark profile for `fw monitor`

Danny — Fri, 20 Oct 2017 07:44:34 GMT

Wireshark Profiles - English version via Google Translate

How to work with large traffic capture files

What is FW Monitor?

How to use FW Monitor

What happened to Check Point Ethereal (CPEthereal)?

Re: WireShark profile for `fw monitor`

Hugo_vd_Kooij — Fri, 20 Oct 2017 08:02:30 GMT

WireShark profiles (Translated by Google)

If some lines don't make sense in English. .... That's what you get from bot translators.

You can always try to learn Dutch 😉

Re: WireShark profile for `fw monitor`

Maarten_Sjouw — Fri, 20 Oct 2017 20:59:14 GMT

Wow, I see my post from 2008 on CPUG found it's way back again....

Re: WireShark profile for `fw monitor`

PhoneBoy — Fri, 20 Oct 2017 23:37:38 GMT

Been a while since I've seen this.

Re: WireShark profile for `fw monitor`

Ofir_Shikolski — Sun, 22 Oct 2017 07:09:39 GMT

cool

I even more like this one : Hugo's website: PowerShell, AD computers to Check Point objects -> psCheckPoint Documentation

Re: WireShark profile for `fw monitor`

Hugo_vd_Kooij — Thu, 28 Jul 2022 07:46:48 GMT

I found that in the PCAP file we loose something. If you run fw monitor on the screens you can see how things are picked up internally.

The first (i) will be part of the performance pack. And then you get a second (i) on the actual core that picks up the packet. On TCP this is only on the SYN packet. But on UDP this happens a lot more.

It would be cool if fw monitor could be enhanced to put this information into comments if you use pcapng as output format.

Who should we buy strooopwafels to get this into a future version?