topic Re: How to determine top talker host IP in Firewall and Security Management

How to determine top talker host IP

Achilles_Tagg — Wed, 03 Apr 2019 01:42:35 GMT

Want to determine top talker host in checkpoint via cli. Any idea how?

OS: IPSO Kernel Ver. 4.2

Re: How to determine top talker host IP

Timothy_Hall — Wed, 03 Apr 2019 02:03:12 GMT

Assuming SecureXL (flows) is enabled, you should be able to use the Top Talkers script by @Craig_Dods, not sure if it will work on IPSO but worth a try:

http😕/expert-mode.blogspot.com/2013/05/checkpoint-top-talkers-script-display.html

Re: How to determine top talker host IP

PhoneBoy — Wed, 03 Apr 2019 02:04:35 GMT

IPSO 4.2 implies you're running R65 or earlier, which hasn't been supported for quite a while. Pretty sure there is no facility for this in those releases. You might be able to write a script to parse the connections table to see who the top talker is "right now."

SmartView Monitor may be an option assuming you have a license for it and it runs on IPSO (don't remember if it's supported or not). Otherwise, you'd have to parse the logs to figure this out.

Re: How to determine top talker host IP

HeikoAnkenbrand — Sat, 06 Apr 2019 20:39:57 GMT

Source IP Top 10

fwaccel conns | awk '{print $1}' | sort | uniq -c | sort -n -r | head -n 10

Destination IP Top 10

fwaccel conns | awk '{print $3}' | sort | uniq -c | sort -n -r | head -n 10

Re: How to determine top talker host IP

HeikoAnkenbrand — Sat, 06 Apr 2019 20:43:06 GMT

You can also use "fw tab -t connections -u -f" and change the parameter for the "print $x" command.

Re: How to determine top talker host IP

Achilles_Tagg — Tue, 07 May 2019 01:46:57 GMT

Appreciate it! Thanks

Re: How to determine top talker host IP

Bryce_Myers — Mon, 05 Aug 2019 17:28:26 GMT

You can use Smartview Monitor from the CLI with rtm monitor.

For example:

# rtm monitor -k src -v wb sort=top -i 60

Will give you an output every 60 seconds of top source addresses.

Re: How to determine top talker host IP

Simon_Macpherso — Mon, 22 Jul 2024 23:57:28 GMT

HI @HeikoAnkenbrand in the context of using fw tab -t connections -u -f, can you please explain what you mean by changing the parameter for the print $x command?