topic Re: "fw ctl zdebug" Helpful Command Combinations in Firewall and Security Management

"fw ctl zdebug" Helpful Command Combinations

HeikoAnkenbrand — Wed, 20 Mar 2019 20:25:42 GMT

"fw ctl zdebug" is a powertool that is not exhausted from being used with "fw ctl zdebug drop". There is not much to be found in Check Point KB or in the documentation. "fw ctl zdebug" is an R&D tool for testing software in development. Therefore, the insert should be used with care. It starts a debugging in the background until it is aborted with CTRL+C. On productive systems it can have a high performance impact. Furthermore, the debug buffer is not the largest.

What happens when you execute! It is a macro that executes the following commands:

fw ctl debug -buf 1024
fw ctl debug [The option behind "fw ctl zdebug"]
fw ctl kdebug -f
[Wait until CTRL+C is pressed]
fw ctl debug 0

Node:

A current list with kernel debug flags can be found here.

Kernel Debug Flags R80.10

Kernel Debug Flags R77

Here are some good examples for debugging:

fw ctl zdebug + packet
fw ctl zdebug + packet | grep -B 1 TCP |grep -B 1 "(SYN)"      <<< change SYN-ACK,ACK,FIN,... and/or UDP,TCP...
fw ctl zdebug + all |grep -A 1 "Monitor" | grep "1.1.1.1"            <<< change IP address
fw ctl zdebug + all |grep -A 2 "Monitor"
fw ctl zdebug + sync
fw ctl zdebug + conn |grep "After VM:" |grep "(SYN)"
fw ctl zdebug + xlate
fw ctl zdebug + monitorall                                                     <<< use with host IP "| grep 1.1.1.1" or network range "| grep 1.1."
fw ctl zdebug + monitor                                                            <<< use with host IP "| grep 1.1.1.1" or network range "| grep 1.1."
fw ctl zdebug + filter conn | grep -A 8 "rule 1"                          <<< change rule number - show connetions to rule xyz
fw ctl zdebug + filter monitor | grep -A 8 "rule 2"                     <<< change rule number - show connetions to rule xyz

Attention, if you turn on debugging, this will affect the performance of the firewall.

Regards,

Heiko

Re: "fw ctl zdebug" Helpful Command Combinations

Ariel_Soller — Wed, 13 Jun 2018 12:26:18 GMT

Hi Heiko,

That's super interesting!

Are there any other "fw ctl zdebug" commands?

Re: "fw ctl zdebug" Helpful Command Combinations

GG27 — Fri, 15 Jun 2018 12:15:28 GMT

Hello mates,

That's very useful post, but I don't understand what the reason is why there's no official documentation in SK

Thanks Heiko for your post

Re: "fw ctl zdebug" Helpful Command Combinations

PhoneBoy — Fri, 15 Jun 2018 14:04:27 GMT

fw ctl zdebug options are documented in the topic-specific ATRGs in SecureKnowledge.

Re: "fw ctl zdebug" Helpful Command Combinations

HeikoAnkenbrand — Sat, 16 Jun 2018 11:07:20 GMT

Principle all debug modules are possible for debugging with „fw ctl zdebug“.

„fw ctl debug -h“ shows all current kernel debugging options for modules and instances.

You can use various combinations.

Unfortunately, the commands are only mentioned in few SK's. Try it out here. I have described the most important ones above.

I would be pleased about new interesting combinations.

Regards,

Heiko

Re: "fw ctl zdebug" Helpful Command Combinations

Kai_O_ — Mon, 18 Jun 2018 12:29:53 GMT

It's a great tool. I didn't know you could do so much with it. I have only worked with "fw ctl zdebug drop" and did not recognize the potentiality.

Thanks for the info.

Re: "fw ctl zdebug" Helpful Command Combinations

JozkoMrkvicka — Sun, 12 Aug 2018 14:26:52 GMT

fw ctl zdebug drop = debug of IPv4 connections

fw6 ctl zdebug drop = debug of IPv6 connections.

all flags and options listed here should be also valid for IPv6 (fw6).

Re: "fw ctl zdebug" Helpful Command Combinations

Don_Paterson — Wed, 05 Dec 2018 16:11:43 GMT

Nice post. Thanks Heiko.

In the original post there is this line:

fw ctl debug [The option behind "fw ctl zdebug"]

Is that not more like a fw ctl debug -m fw [options/flags] ?

I think I remember the zdebug focuses on the fw kernel module but I think I also remember that some other kernel module debug flags may also be set.

I know that the (DON'T DO THIS IN PRODUCTION) option of 'fw ctl zdebug all' adds debug flags to three or four other kernel modules but not all.

The fw module gets all debug flags set in that case.

fw ctl zdebug -m CPAS all would be required if, for example, the CPAS module was interesting for a full debug. The command above would not then be of use.

What is the monitorall option doing?

Regards,

Don

Re: "fw ctl zdebug" Helpful Command Combinations

PhoneBoy — Wed, 05 Dec 2018 18:18:45 GMT

I think it's just turning up the debug level a bit.

Re: "fw ctl zdebug" Helpful Command Combinations

Achilles_Tagg — Thu, 28 Mar 2019 02:35:26 GMT

This is very useful! Thanks for sharing... .

Re: "fw ctl zdebug" Helpful Command Combinations

Maarten_Sjouw — Thu, 28 Mar 2019 16:16:09 GMT

Very nice Heiko.
I think that the most useful part of using the command is that when you stop the debug you are running it really stops all debugging, so you cannot forget to turn it off again.

Re: "fw ctl zdebug" Helpful Command Combinations

Yoel_Maaravi — Fri, 06 Sep 2019 06:04:26 GMT

fw ctl zdebug + monitorall -> shows many fw chain modules

Re: "fw ctl zdebug" Helpful Command Combinations

Solo — Thu, 12 Dec 2019 02:31:48 GMT

so helpful,thanks.

Re: "fw ctl zdebug" Helpful Command Combinations

Mike_Jensen — Mon, 29 Nov 2021 18:50:31 GMT

I am currently running R80.30 with JHFA take 237. I used to be able to run fw ctl zdebug + drop | grep 10.x.x.x , but that hasn't worked in a while. When I try to grep for a ip address it is as if the debug never loads and hangs there. This is true on all of my gateways. Has something changed in regards to this?

Re: "fw ctl zdebug" Helpful Command Combinations

Zolo — Sun, 18 Jun 2023 07:30:20 GMT

You can use "-F" option instead of "grep".

fw ctl zdebug -F '10.x.x.x,0,0,0,0' -F '0,0,10.x.x.x,0,0' + drop