topic Kernel debug - zdebug - F filtering not working in R82 T44 in Firewall and Security Management

Kernel debug - zdebug - F filtering not working in R82 T44

Don_Paterson — Thu, 20 Nov 2025 18:07:51 GMT

I am doing a zdebug and wanting to filter with -F.

In the past that worked well for me but not on the R82 SG VM today.

fw ctl zdebug -T + drop -F "192.168.99.199,0,1.2.3.4,0,0"

EDIT:

I left out + drop in my original post but I believe the problem is still there. Added + drop in above.

When I do this I see drops, but not only the desired drops:

fw ctl zdebug -T + drop

END OF EDIT.

Conclusion:
The filters are confirmed to be enabled/active but don't work (regardless of quotations or not around the filter):

Simple Debug Filter Is Activated
Tuple Protocol Source:Port Destination:Port
(1) * 192.168.99.199:* 1.2.3.4:*

I have to do this to get the filtered output (as apposed to no ouput at all from the above command):

fw ctl debug 0 fw ctl set str simple_debug_filter_daddr_1 1.2.3.4 fw ctl set str simple_debug_filter_saddr_1 192.168.99.199 fw ctl debug -buf 8200 fw ctl debug | grep buf fw ctl debug -m fw + drop fw ctl ndebug -T -o /var/log/ndebug-debug-drop.txt

--- ping to get the drop -----

CTRL + C fw ctl debug 0 more /var/log/ndebug-debug-drop.txt

Re: Kernel debug - zdebug - F filtering not working in R82 T44

PhoneBoy — Thu, 20 Nov 2025 16:06:25 GMT

Sounds like a bug.
Yes, I know it's a lab, but was a TAC case opened?

Re: Kernel debug - zdebug - F filtering not working in R82 T44

Don_Paterson — Thu, 20 Nov 2025 16:55:27 GMT

No. I haven't opened a case.

Only been updating some procedures and learning and testing.

Can you give someone in RnD a nudge?

Re: Kernel debug - zdebug - F filtering not working in R82 T44

the_rock — Thu, 20 Nov 2025 17:42:20 GMT

Hey Don aka Steve,

I just tried it in my lab R82 jumbo 44 and it did not give any errors, appears as command would actually work.

Re: Kernel debug - zdebug - F filtering not working in R82 T44

Don_Paterson — Thu, 20 Nov 2025 17:47:06 GMT

Hi Andy,

Did you do a zdebug with the -T and -F and a filter in quotes?

I've seen fw monitor not work because of quotes used around the actual filter but not zdebug.

Cheers,

Don

Re: Kernel debug - zdebug - F filtering not working in R82 T44

the_rock — Thu, 20 Nov 2025 17:49:12 GMT

I did, yes.

Re: Kernel debug - zdebug - F filtering not working in R82 T44

Don_Paterson — Thu, 20 Nov 2025 18:26:08 GMT

OK, you will see I edited my post (I left off the + drop in my original post (but not in my testing lab!)).

This is the command to test, with IP addresses relevant to your lab of course.

fw ctl zdebug -T + drop -F "192.168.99.199,0,1.2.3.4,0,0"

Re: Kernel debug - zdebug - F filtering not working in R82 T44

Don_Paterson — Thu, 20 Nov 2025 18:09:58 GMT

And you know I am gonna ask for a screenshot 😄

Re: Kernel debug - zdebug - F filtering not working in R82 T44

the_rock — Thu, 20 Nov 2025 18:30:34 GMT

For any Don or Steve out there, NO charge 😉

**********************************************

[Expert@CP-GW:0]# cpinfo -yfw1

This is Check Point CPinfo Build 914000250 for GAIA
[FW1]
HOTFIX_R80_40_MAAS_TUNNEL_AUTOUPDATE
HOTFIX_R82_JUMBO_HF_MAIN Take: 44
HOTFIX_UCA_SSH_TUNNELING_SERVICE_AUTOUPDATE
HOTFIX_UCA_SSH_TUNNELING_APP_AUTOUPDATE
HOTFIX_UCA_INFRA_MONITOR_SERVICE_AUTOUPDATE
HOTFIX_UCA_INFRA_LOG_SERVICE_AUTOUPDATE
HOTFIX_UCA_INFRA_AUTOUPDATE
HOTFIX_PUBLIC_CLOUD_CA_BUNDLE_AUTOUPDATE
HOTFIX_INEXT_NANO_EGG_AUTOUPDATE
HOTFIX_GOT_TPCONF_AUTOUPDATE

FW1 build number:
This is Check Point's software version R82 - Build 010
kernel: R82 - Build 008

[Expert@CP-GW:0]# fw ctl zdebug -T + drop -F "192.168.99.199,0,1.2.3.4,0,0"
Defaulting all kernel debugging options, may take a while
Debug state was reset to default.
PPAK 0: Get before set operation succeeded of simple_debug_filter_off
Initialized kernel debugging buffer to size 1023K
fw ctl set string simple_debug_filter_saddr_1 192.168.99.199 -a
PPAK 0: Get before set operation succeeded of simple_debug_filter_saddr_1
fw ctl set int simple_debug_filter_sport_1 0 -a
PPAK 0: Get before set operation succeeded of simple_debug_filter_sport_1
fw ctl set string simple_debug_filter_daddr_1 1.2.3.4 -a
PPAK 0: Get before set operation succeeded of simple_debug_filter_daddr_1
fw ctl set int simple_debug_filter_dport_1 0 -a
PPAK 0: Get before set operation succeeded of simple_debug_filter_dport_1
fw ctl set int simple_debug_filter_proto_1 0 -a
PPAK 0: Get before set operation succeeded of simple_debug_filter_proto_1
Kernel debugging buffer size: 1023KB
HOST:
Module: kiss
Enabled Kernel debugging options: error warning htab_bl_err
Messaging threshold set to type=Notice freq=Common

-----------------------------------------------------
SecureXL:
Module: kiss
Enabled Kernel debugging options: error warning htab_bl_err
Messaging threshold set to type=Notice freq=Common

-----------------------------------------------------
HOST:
Module: kissflow
Enabled Kernel debugging options: error warning
Messaging threshold set to type=Info freq=Common

-----------------------------------------------------
SecureXL:
Module: kissflow
Enabled Kernel debugging options: error warning
Messaging threshold set to type=Info freq=Common

-----------------------------------------------------
HOST:
Module: fw
Enabled Kernel debugging options: error warning
Messaging threshold set to type=Info freq=Common

-----------------------------------------------------
SecureXL:
Module: seqvalid
Enabled Kernel debugging options: error warning
Messaging threshold set to type=Info freq=Common

-----------------------------------------------------
HOST:
Module: h323
Enabled Kernel debugging options: error
Messaging threshold set to type=Info freq=Common

-----------------------------------------------------
SecureXL:
Module: synatk
Enabled Kernel debugging options: None

-----------------------------------------------------
HOST:
Module: cpcode
Enabled Kernel debugging options: error warning
Messaging threshold set to type=Info freq=Common

-----------------------------------------------------
SecureXL:
Module: fg
Enabled Kernel debugging options: error
Messaging threshold set to type=Info freq=Common

-----------------------------------------------------
HOST:
Module: upconv
Enabled Kernel debugging options: error warning info
Messaging threshold set to type=Info freq=Common

-----------------------------------------------------
HOST:
Module: WS_SIP
Enabled Kernel debugging options: None

-----------------------------------------------------
HOST:
Module: crypto
Enabled Kernel debugging options: error warning
Messaging threshold set to type=Info freq=Common

-----------------------------------------------------
HOST:
Module: multik
Enabled Kernel debugging options: None

-----------------------------------------------------
HOST:
Module: PSL
Enabled Kernel debugging options: error warning
Messaging threshold set to type=Info freq=Common

-----------------------------------------------------
HOST:
Module: CPAS
Enabled Kernel debugging options: error warning
Messaging threshold set to type=Info freq=Common

-----------------------------------------------------
HOST:
Module: UDP_IS
Enabled Kernel debugging options: error warning
Messaging threshold set to type=Info freq=Common

-----------------------------------------------------
HOST:
Module: seqvalid
Enabled Kernel debugging options: error warning
Messaging threshold set to type=Info freq=Common

-----------------------------------------------------
HOST:
Module: synatk
Enabled Kernel debugging options: None

-----------------------------------------------------
HOST:
Module: MUX
Enabled Kernel debugging options: error warning
Messaging threshold set to type=Info freq=Common

-----------------------------------------------------
HOST:
Module: CPSSH
Enabled Kernel debugging options: error warning
Messaging threshold set to type=Info freq=Common

-----------------------------------------------------
HOST:
Module: fg
Enabled Kernel debugging options: error
Messaging threshold set to type=Info freq=Common

-----------------------------------------------------
HOST:
Module: UC
Enabled Kernel debugging options: None

-----------------------------------------------------
HOST:
Module: dlpk
Enabled Kernel debugging options: None

-----------------------------------------------------
HOST:
Module: dlpuk
Enabled Kernel debugging options: None

-----------------------------------------------------
HOST:
Module: SDWAN
Enabled Kernel debugging options: error warning
Messaging threshold set to type=Info freq=Common

-----------------------------------------------------
HOST:
Module: cpconntim
Enabled Kernel debugging options: error warning
Messaging threshold set to type=Info freq=Common

-----------------------------------------------------
HOST:
Module: gtp
Enabled Kernel debugging options: None

-----------------------------------------------------
HOST:
Module: VPN
Enabled Kernel debugging options: err
Messaging threshold set to type=Info freq=Common

-----------------------------------------------------
HOST:
Module: WSIS
Enabled Kernel debugging options: None

-----------------------------------------------------
HOST:
Module: UPIS
Enabled Kernel debugging options: None

-----------------------------------------------------
HOST:
Module: cmi_loader
Enabled Kernel debugging options: None

-----------------------------------------------------
HOST:
Module: NRB
Enabled Kernel debugging options: None

-----------------------------------------------------
HOST:
Module: SGEN
Enabled Kernel debugging options: None

-----------------------------------------------------
HOST:
Module: RAD_KERNEL
Enabled Kernel debugging options: None

-----------------------------------------------------
HOST:
Module: WS
Enabled Kernel debugging options: None

-----------------------------------------------------
HOST:
Module: APPI
Enabled Kernel debugging options: None

-----------------------------------------------------
HOST:
Module: UP
Enabled Kernel debugging options: None

-----------------------------------------------------
HOST:
Module: MALWARE
Enabled Kernel debugging options: None

-----------------------------------------------------
HOST:
Module: UCA
Enabled Kernel debugging options: None

-----------------------------------------------------
HOST:
Module: CI
Enabled Kernel debugging options: None

-----------------------------------------------------
HOST:
Module: SFT
Enabled Kernel debugging options: None

-----------------------------------------------------
HOST:
Module: ICAP_CLIENT
Enabled Kernel debugging options: None

-----------------------------------------------------
HOST:
Module: FILEAPP
Enabled Kernel debugging options: None

-----------------------------------------------------
HOST:
Module: dlpda
Enabled Kernel debugging options: None

-----------------------------------------------------
HOST:
Module: FILE_SECURITY
Enabled Kernel debugging options: None

-----------------------------------------------------
HOST:
Module: TPUTILS
Enabled Kernel debugging options: None

-----------------------------------------------------
HOST:
Module: ZPH
Enabled Kernel debugging options: None

-----------------------------------------------------
HOST:
Module: DOMO
Enabled Kernel debugging options: None

-----------------------------------------------------
HOST:
Module: SDWANRB
Enabled Kernel debugging options: None

-----------------------------------------------------
HOST:
Module: IDAPI
Enabled Kernel debugging options: None

-----------------------------------------------------
HOST:
Module: RTM
Enabled Kernel debugging options: err
Messaging threshold set to type=Info freq=Common

-----------------------------------------------------
Kernel debugging buffer size: 1023KB
HOST:
Module: kiss
Enabled Kernel debugging options: error warning htab_bl_err
Messaging threshold set to type=Notice freq=Common