topic Re: tcpdump, fw monitor and fw ctl zdebug commands and performance impact in Firewall and Security Management

tcpdump, fw monitor and fw ctl zdebug commands and performance impact

DmitriyDubovik — Fri, 27 Oct 2023 12:48:43 GMT

Good day

We have highly loaded security gateways that currently need traffic analysis.

In this article https://community.checkpoint.com/t5/Security-Gateways/quot-fw-ctl-zdebug-quot-Helpful-Command-Combinations/td-p/40680 I came across information that the utility negatively affects on performance .

Please tell me how critically it can affect on performance, which of the systems (CPU, RAM, traffic) is loaded the most?

Is it possible to reduce resource consumption through parameters like specifying the interface that will be dump?

How much traffic can fw monitor and tcpdump also load?

Re: tcpdump, fw monitor and fw ctl zdebug commands and performance impact

Alex- — Fri, 27 Oct 2023 13:01:53 GMT

Use cppcap instead of tcpdump.

Kernel debug will have an impact on your FW, especially if it's already loaded as you say. They have to be started and stopped properly.

It's best to consult first with TAC to review your situation.

Re: tcpdump, fw monitor and fw ctl zdebug commands and performance impact

DmitriyDubovik — Fri, 27 Oct 2023 13:09:25 GMT

TAC give you an answer for multiple days, we can t wait so long. Problem is in thing, that documentation don t describe important things like how much impact of performance, in what situation we can it on, in what we cant and another things...

Re: tcpdump, fw monitor and fw ctl zdebug commands and performance impact

DmitriyDubovik — Fri, 27 Oct 2023 13:11:10 GMT

And the most interesting question is whether the load will change depending on the parameters that you set

Re: tcpdump, fw monitor and fw ctl zdebug commands and performance impact

G_W_Albrecht — Fri, 27 Oct 2023 13:42:12 GMT

Can you please explain why you need tcpdump and fw monitor for traffic analysis ? Usually cpview gives you the needed look into secureXL state, see the following:

sk167553: Performance Investigation Procedure - How To

sk98348: Best Practices - Security Gateway Performance

Re: tcpdump, fw monitor and fw ctl zdebug commands and performance impact

DmitriyDubovik — Fri, 27 Oct 2023 13:47:59 GMT

unstable traffic in video conferences without any negative symptoms (packet drops in the smartlog, CPU overload, and etc) is a main problem