topic fw monitor in Firewall and Security Management

fw monitor

Vladimir_S — Sat, 23 Aug 2025 03:33:15 GMT

Hello,

I need to monitor inbound traffic between an external source and Check Point security gateway external interface on port 443.

R82 Take 12 runs on the security gateway.

Here is the syntaxis of fw monitor that I use on the gateway:

fw monitor -F "0.0.0.0, 0, 12.69.98.28, 443, 6" -pi

And here is output:

PPAK 0: Get before set operation succeeded of fwmonitor_kiss_enable
PPAK 0: Get before set operation succeeded of fwmonitor_debug_filter_off
PPAK 0: Get before set operation succeeded of fwmonitorfreebufs
Invalid destination IP address 12.X.X.28 in debug filter

I replaced part of the public IP address of my gateway with X.

Any suggestions to get correct output?

Thank you.

Re: fw monitor

Lesley — Sat, 23 Aug 2025 07:53:03 GMT

Try:

fw monitor -m i -F "0,0,1.1.1.1,443,0"
replace 1.1.1.1 with your ip and please edit your post in the output you still can see the full public ip

Re: fw monitor

Vladimir_S — Sun, 24 Aug 2025 01:37:31 GMT

Hi Lesley,

The command worked!! Another question, for the fw monitor filter, what expression should be added to capture ICMP traffic?

Thank you,

Vlad.

Re: fw monitor

Lesley — Sun, 24 Aug 2025 05:52:03 GMT

fw monitor -m i -F "0,0,1.1.1.1,0,1"

Re: fw monitor

Vladimir_S — Mon, 25 Aug 2025 01:07:47 GMT

Thank you Lesley, it works too!!

Vlad.