topic Re: Firewall Decom: Investigating Interface Traffic in Firewall and Security Management https://community.checkpoint.com/t5/Firewall-and-Security-Management/Firewall-Decom-Investigating-Interface-Traffic/m-p/258949#M50796 <P>CPview showed the 0 traffic interfaces but also trying to see interfaces with syn sent traffic since there has been a lot of uplift in moving to the cloud.</P><P>ip route | grep “scope link” | awk ‘{print $1, $3}’</P><P>so far in smart view I have a query for (((original:”fw”)(“ethX”)) AND (NOT action:”Drop”)) AND (“Subnet from IP route command)</P><P>&nbsp;</P><P>can create an excel spreadsheet from here but there isn’t a good way to also filter for syn sent traffic to really narrow down which devices are no longer in service behind that interface</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Fri, 03 Oct 2025 19:06:06 GMT Fatalis 2025-10-03T19:06:06Z Firewall Decom: Investigating Interface Traffic https://community.checkpoint.com/t5/Firewall-and-Security-Management/Firewall-Decom-Investigating-Interface-Traffic/m-p/258926#M50786 <P>Hi everyone,</P><P>&nbsp;</P><P>I’m currently working on decommissioning a soon to be EOL firewall and want to insure we don’t remove any interfaces that are still in use.&nbsp;<BR /><BR /></P><P>How did others here perform interface traffic investigations to determine which sub-interfaces were still actively used?&nbsp;<BR /><BR /></P><P>maybe some tips on automating these checks as well.</P><P>&nbsp;</P><P>Thanks in advance for sharing your experience!</P> Fri, 03 Oct 2025 15:49:34 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Firewall-Decom-Investigating-Interface-Traffic/m-p/258926#M50786 Fatalis 2025-10-03T15:49:34Z Re: Firewall Decom: Investigating Interface Traffic https://community.checkpoint.com/t5/Firewall-and-Security-Management/Firewall-Decom-Investigating-Interface-Traffic/m-p/258930#M50790 <P><SPAN><STRONG><A href="https://support.checkpoint.com/results/sk/sk101878" target="_self">CPView</A></STRONG> provides real-time and historical performance data, including traffic stats per interface. </SPAN><CODE> </CODE></P> <UL> <LI> <P><SPAN>Navigate to Network &gt; Interfaces</SPAN></P> </LI> <LI> <P><SPAN>You'll see traffic stats like packets per second, bytes in/out, errors, drops, etc.</SPAN></P> </LI> <LI> <P><SPAN>CPView stores up to 7 days of historical data</SPAN></P> </LI> <LI> <P><SPAN>Use the arrow keys to scroll through time and observe traffic trends</SPAN></P> </LI> <LI> <P><SPAN>Look for interfaces with consistent zero traffic &gt; likely candidates for decommissioning</SPAN></P> </LI> </UL> <P><STRONG><A href="https://community.checkpoint.com/t5/Telemetry/System-Activity-Report-SAR-visualization/m-p/173783/highlight/true#M16" target="_self">System Activity Report (SAR)</A></STRONG></P> <UL> <LI><SPAN>easily visualize if there is any traffic on your network interfaces</SPAN></LI> </UL> <P><STRONG><A href="https://sc1.checkpoint.com/documents/R82/SmartConsole_OLH/EN/Topics-OLH/Home-Page.htm" target="_self">SmartConsole</A></STRONG></P> <UL> <LI><SPAN>look up interfaces statics and logs directly in Check Point's SmartConsole in case you have access to it</SPAN></LI> </UL> Fri, 03 Oct 2025 18:27:14 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Firewall-Decom-Investigating-Interface-Traffic/m-p/258930#M50790 Danny 2025-10-03T18:27:14Z Re: Firewall Decom: Investigating Interface Traffic https://community.checkpoint.com/t5/Firewall-and-Security-Management/Firewall-Decom-Investigating-Interface-Traffic/m-p/258931#M50791 <P>I would agree with Danny that cpview is definitely your best bet. You can also use ethtool -S as well, below is example from my lab.</P> <P>Andy</P> <P>[Expert@CP-GW:0]# ethtool -S eth0<BR />NIC statistics:<BR />Tx Queue#: 0<BR />TSO pkts tx: 0<BR />TSO bytes tx: 0<BR />ucast pkts tx: 334970<BR />ucast bytes tx: 45103164<BR />mcast pkts tx: 0<BR />mcast bytes tx: 0<BR />bcast pkts tx: 0<BR />bcast bytes tx: 0<BR />pkts tx err: 0<BR />pkts tx discard: 0<BR />drv dropped tx total: 0<BR />too many frags: 0<BR />giant hdr: 0<BR />hdr err: 0<BR />tso: 0<BR />ring full: 0<BR />pkts linearized: 0<BR />hdr cloned: 0<BR />giant hdr: 0<BR />Tx Queue#: 1<BR />TSO pkts tx: 0<BR />TSO bytes tx: 0<BR />ucast pkts tx: 153593388<BR />ucast bytes tx: 13252708906<BR />mcast pkts tx: 0<BR />mcast bytes tx: 0<BR />bcast pkts tx: 359<BR />bcast bytes tx: 15078<BR />pkts tx err: 0<BR />pkts tx discard: 0<BR />drv dropped tx total: 0<BR />too many frags: 0<BR />giant hdr: 0<BR />hdr err: 0<BR />tso: 0<BR />ring full: 0<BR />pkts linearized: 0<BR />hdr cloned: 0<BR />giant hdr: 0<BR />Tx Queue#: 2<BR />TSO pkts tx: 0<BR />TSO bytes tx: 0<BR />ucast pkts tx: 348933<BR />ucast bytes tx: 28255078<BR />mcast pkts tx: 0<BR />mcast bytes tx: 0<BR />bcast pkts tx: 0<BR />bcast bytes tx: 0<BR />pkts tx err: 0<BR />pkts tx discard: 0<BR />drv dropped tx total: 0<BR />too many frags: 0<BR />giant hdr: 0<BR />hdr err: 0<BR />tso: 0<BR />ring full: 0<BR />pkts linearized: 0<BR />hdr cloned: 0<BR />giant hdr: 0<BR />Tx Queue#: 3<BR />TSO pkts tx: 0<BR />TSO bytes tx: 0<BR />ucast pkts tx: 347901<BR />ucast bytes tx: 56831727<BR />mcast pkts tx: 0<BR />mcast bytes tx: 0<BR />bcast pkts tx: 0<BR />bcast bytes tx: 0<BR />pkts tx err: 0<BR />pkts tx discard: 0<BR />drv dropped tx total: 0<BR />too many frags: 0<BR />giant hdr: 0<BR />hdr err: 0<BR />tso: 0<BR />ring full: 0<BR />pkts linearized: 0<BR />hdr cloned: 0<BR />giant hdr: 0<BR />Tx Queue#: 4<BR />TSO pkts tx: 0<BR />TSO bytes tx: 0<BR />ucast pkts tx: 76955137<BR />ucast bytes tx: 6682824805<BR />mcast pkts tx: 0<BR />mcast bytes tx: 0<BR />bcast pkts tx: 0<BR />bcast bytes tx: 0<BR />pkts tx err: 0<BR />pkts tx discard: 0<BR />drv dropped tx total: 0<BR />too many frags: 0<BR />giant hdr: 0<BR />hdr err: 0<BR />tso: 0<BR />ring full: 0<BR />pkts linearized: 0<BR />hdr cloned: 0<BR />giant hdr: 0<BR />Tx Queue#: 5<BR />TSO pkts tx: 0<BR />TSO bytes tx: 0<BR />ucast pkts tx: 869589<BR />ucast bytes tx: 762671634<BR />mcast pkts tx: 0<BR />mcast bytes tx: 0<BR />bcast pkts tx: 0<BR />bcast bytes tx: 0<BR />pkts tx err: 0<BR />pkts tx discard: 0<BR />drv dropped tx total: 0<BR />too many frags: 0<BR />giant hdr: 0<BR />hdr err: 0<BR />tso: 0<BR />ring full: 0<BR />pkts linearized: 0<BR />hdr cloned: 0<BR />giant hdr: 0<BR />Tx Queue#: 6<BR />TSO pkts tx: 0<BR />TSO bytes tx: 0<BR />ucast pkts tx: 440299<BR />ucast bytes tx: 132009956<BR />mcast pkts tx: 0<BR />mcast bytes tx: 0<BR />bcast pkts tx: 0<BR />bcast bytes tx: 0<BR />pkts tx err: 0<BR />pkts tx discard: 0<BR />drv dropped tx total: 0<BR />too many frags: 0<BR />giant hdr: 0<BR />hdr err: 0<BR />tso: 0<BR />ring full: 0<BR />pkts linearized: 0<BR />hdr cloned: 0<BR />giant hdr: 0<BR />Tx Queue#: 7<BR />TSO pkts tx: 0<BR />TSO bytes tx: 0<BR />ucast pkts tx: 471514<BR />ucast bytes tx: 45065140<BR />mcast pkts tx: 0<BR />mcast bytes tx: 0<BR />bcast pkts tx: 0<BR />bcast bytes tx: 0<BR />pkts tx err: 0<BR />pkts tx discard: 0<BR />drv dropped tx total: 0<BR />too many frags: 0<BR />giant hdr: 0<BR />hdr err: 0<BR />tso: 0<BR />ring full: 0<BR />pkts linearized: 0<BR />hdr cloned: 0<BR />giant hdr: 0<BR />Rx Queue#: 0<BR />LRO pkts rx: 5035613<BR />LRO byte rx: 7623453773<BR />ucast pkts rx: 236157971<BR />ucast bytes rx: 48848667488<BR />mcast pkts rx: 2<BR />mcast bytes rx: 238<BR />bcast pkts rx: 1748031<BR />bcast bytes rx: 106465947<BR />pkts rx OOB: 0<BR />pkts rx err: 0<BR />drv dropped rx total: 0<BR />err: 0<BR />fcs: 0<BR />rx buf alloc fail: 0<BR />Rx Queue#: 1<BR />LRO pkts rx: 0<BR />LRO byte rx: 0<BR />ucast pkts rx: 0<BR />ucast bytes rx: 0<BR />mcast pkts rx: 0<BR />mcast bytes rx: 0<BR />bcast pkts rx: 0<BR />bcast bytes rx: 0<BR />pkts rx OOB: 0<BR />pkts rx err: 0<BR />drv dropped rx total: 0<BR />err: 0<BR />fcs: 0<BR />rx buf alloc fail: 0<BR />Rx Queue#: 2<BR />LRO pkts rx: 0<BR />LRO byte rx: 0<BR />ucast pkts rx: 0<BR />ucast bytes rx: 0<BR />mcast pkts rx: 0<BR />mcast bytes rx: 0<BR />bcast pkts rx: 0<BR />bcast bytes rx: 0<BR />pkts rx OOB: 0<BR />pkts rx err: 0<BR />drv dropped rx total: 0<BR />err: 0<BR />fcs: 0<BR />rx buf alloc fail: 0<BR />Rx Queue#: 3<BR />LRO pkts rx: 0<BR />LRO byte rx: 0<BR />ucast pkts rx: 0<BR />ucast bytes rx: 0<BR />mcast pkts rx: 0<BR />mcast bytes rx: 0<BR />bcast pkts rx: 0<BR />bcast bytes rx: 0<BR />pkts rx OOB: 0<BR />pkts rx err: 0<BR />drv dropped rx total: 0<BR />err: 0<BR />fcs: 0<BR />rx buf alloc fail: 0<BR />Rx Queue#: 4<BR />LRO pkts rx: 0<BR />LRO byte rx: 0<BR />ucast pkts rx: 0<BR />ucast bytes rx: 0<BR />mcast pkts rx: 0<BR />mcast bytes rx: 0<BR />bcast pkts rx: 0<BR />bcast bytes rx: 0<BR />pkts rx OOB: 0<BR />pkts rx err: 0<BR />drv dropped rx total: 0<BR />err: 0<BR />fcs: 0<BR />rx buf alloc fail: 0<BR />Rx Queue#: 5<BR />LRO pkts rx: 0<BR />LRO byte rx: 0<BR />ucast pkts rx: 0<BR />ucast bytes rx: 0<BR />mcast pkts rx: 0<BR />mcast bytes rx: 0<BR />bcast pkts rx: 0<BR />bcast bytes rx: 0<BR />pkts rx OOB: 0<BR />pkts rx err: 0<BR />drv dropped rx total: 0<BR />err: 0<BR />fcs: 0<BR />rx buf alloc fail: 0<BR />Rx Queue#: 6<BR />LRO pkts rx: 0<BR />LRO byte rx: 0<BR />ucast pkts rx: 0<BR />ucast bytes rx: 0<BR />mcast pkts rx: 0<BR />mcast bytes rx: 0<BR />bcast pkts rx: 0<BR />bcast bytes rx: 0<BR />pkts rx OOB: 0<BR />pkts rx err: 0<BR />drv dropped rx total: 0<BR />err: 0<BR />fcs: 0<BR />rx buf alloc fail: 0<BR />Rx Queue#: 7<BR />LRO pkts rx: 0<BR />LRO byte rx: 0<BR />ucast pkts rx: 0<BR />ucast bytes rx: 0<BR />mcast pkts rx: 0<BR />mcast bytes rx: 0<BR />bcast pkts rx: 0<BR />bcast bytes rx: 0<BR />pkts rx OOB: 0<BR />pkts rx err: 0<BR />drv dropped rx total: 0<BR />err: 0<BR />fcs: 0<BR />rx buf alloc fail: 0<BR />tx timeout count: 0<BR />[Expert@CP-GW:0]#</P> Fri, 03 Oct 2025 17:09:52 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Firewall-Decom-Investigating-Interface-Traffic/m-p/258931#M50791 the_rock 2025-10-03T17:09:52Z Re: Firewall Decom: Investigating Interface Traffic https://community.checkpoint.com/t5/Firewall-and-Security-Management/Firewall-Decom-Investigating-Interface-Traffic/m-p/258937#M50792 <P>Just use Smart Console, all traffic logs are send there. In here you can filter specific on interface. Every log entry shows the incomming interface you should check. I would not trust interface counts because even if there are zero computers connected to the interface packets still come in, like broadcast etc. They will increase the counter but there is no actual traffic</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Lesley_0-1759513688846.png" style="width: 400px;"><img src="https://community.checkpoint.com/t5/image/serverpage/image-id/31600i45CE739D8DA9DB86/image-size/medium?v=v2&amp;px=400" role="button" title="Lesley_0-1759513688846.png" alt="Lesley_0-1759513688846.png" /></span></P> <P>&nbsp;</P> <P>Right click between the firewall(blade) icon and origin icon:&nbsp;</P> Fri, 03 Oct 2025 17:48:42 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Firewall-Decom-Investigating-Interface-Traffic/m-p/258937#M50792 Lesley 2025-10-03T17:48:42Z Re: Firewall Decom: Investigating Interface Traffic https://community.checkpoint.com/t5/Firewall-and-Security-Management/Firewall-Decom-Investigating-Interface-Traffic/m-p/258949#M50796 <P>CPview showed the 0 traffic interfaces but also trying to see interfaces with syn sent traffic since there has been a lot of uplift in moving to the cloud.</P><P>ip route | grep “scope link” | awk ‘{print $1, $3}’</P><P>so far in smart view I have a query for (((original:”fw”)(“ethX”)) AND (NOT action:”Drop”)) AND (“Subnet from IP route command)</P><P>&nbsp;</P><P>can create an excel spreadsheet from here but there isn’t a good way to also filter for syn sent traffic to really narrow down which devices are no longer in service behind that interface</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Fri, 03 Oct 2025 19:06:06 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Firewall-Decom-Investigating-Interface-Traffic/m-p/258949#M50796 Fatalis 2025-10-03T19:06:06Z