topic Wrieshark run for long period in Firewall and Security Management

Wrieshark run for long period

Dor_Marcovitch — Sun, 24 May 2020 07:08:00 GMT

hey.

for inconstant problems which we need to run wireshark / fw monitor to get a packet capture form the FW.. how do you run this in a way that will keep the fw "safe from crush" and without being connected to the FW.

thanks

dor

Re: Wrieshark run for long period

Timothy_Hall — Sun, 24 May 2020 18:22:47 GMT

For long-running captures I'd suggest using cppcap:

sk141412: Running tcpdump causes high CPU usage - Introducing cppcap

Use of fw monitor for long-running captures is potentially more likely to impact firewall performance since it is essentially "in line" with the chain module sequences (fw ctl chain), and also if someone reinstalls policy to the gateway while an fw monitor is running, the capture will be automatically terminated due to the chain sequences being rebuilt as part of the installation process.

Re: Wrieshark run for long period

HeikoAnkenbrand — Sun, 24 May 2020 18:15:37 GMT

TCPDUMP is a Linux tool which at times is not suitable for use with Gaia. Running TCPDUMP causes a significant increase in CPU usage and as a result impact the performance of the device. Even while filtering by specific interface or port still high CPU occurs. Check Point created a tool which works better with Gaia OS.

"CPPCAP" is a traffic capture tool which provides the most relevant outputs and is similar to Tcpdump. The tool is adjusted to Gaia operating system yet requires installation of an applicable RPM. The good news! SecureXL can be enabled or disabled to capture with CPPCAP.

More read here:
- R80.x - Performance Tuning and Debug Tips - TCPDUMP vs. CPPCAP

Re: Wrieshark run for long period

PhoneBoy — Mon, 25 May 2020 19:32:25 GMT

There's also the "set up a mirror port on your switch" option and running a packet capture on a machine connected to said mirror port.
That obviously requires having a switch where that is possible and having an extra machine.