topic Re: fw monitor - see drop packets in Firewall and Security Management

fw monitor - see drop packets

juanmoreno — Tue, 04 Feb 2020 12:30:25 GMT

Dear all,

In our old enviroment, i had right to run expert mode and when i needed to check dropped packets from a single ip i used to run "fw ctl zdebug drop | grep x.x.x.x"

Now we have a new enviroment on multidomain and i have no expert access to my gw. My problem is that when i run a fwmonitor i can´t grep cause that is for expert mode.

I´have look a lot of official information about fw monitor and i´m sure that is not possible to do.

My question is:

Is any way to see in real-time the dropped packets running cli? ( no expert mode)

Re: fw monitor - see drop packets

PhoneBoy — Fri, 07 Feb 2020 05:17:08 GMT

At a high level you could achieve similar functionality with an extended command pointing to a shell script.
The shell script would take the desired IP as input and run the necessary command with the argument.
You then configure an extended command to point to this script.
See: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk86583

Re: fw monitor - see drop packets

juanmoreno — Mon, 10 Feb 2020 10:13:02 GMT

Hi Phoneboy,

Let me check your info and i tell you what i can get.

Re: fw monitor - see drop packets

HeikoAnkenbrand — Mon, 10 Feb 2020 13:31:45 GMT

Hi @juanmoreno,

With R80.30 you can alternatively use the following command in clish:-)

clish> fw ctl zdebug monitor all

or

clish> fw ctl zdebug drop

fw ctl zdebug is a powertool that is not exhausted from being used with "fw ctl zdebug drop". There is not much to be found in Check Point KB or in the documentation. "fw ctl zdebug" is an R&D tool for testing software in development. Therefore, the insert should be used with care. It starts a debugging in the background until it is aborted with CTRL+C. On productive systems it can have a high performance impact. Furthermore, the debug buffer is not the largest.

Re: fw monitor - see drop packets

juanmoreno — Fri, 08 May 2020 15:48:14 GMT

Hi,

but with this option im not able to filter by one ip, source or destination.

Do you know what i mean?

Best regards

Re: fw monitor - see drop packets

juanmoreno — Fri, 08 May 2020 15:54:19 GMT

Hi Phoneboy,

This solution is not for me required.

i want to see dropped packets filtering one ip in clish.

Best regards.