topic Re: Interface utilization is going 98% (recieved) in the VSX gateway in Firewall and Security Management

Interface utilization is going 98% (recieved) in the VSX gateway

vikupoi_123 — Tue, 07 Jul 2020 11:27:22 GMT

Hi All,

In of our Checkpoint box inetrface utilization is going 98%(recieved) so just want to know which which users are sending the most

traffic and try to catch them . Gateway is R77.30 and want to know the output just like "ip-accounting" in Cisco ...

Please require your support .

Re: Interface utilization is going 98% (recieved) in the VSX gateway

vikupoi_123 — Tue, 07 Jul 2020 12:04:03 GMT

Hi All

One thing also want to add that eth1-06 is the physical interface of the VSX gateway which is showing 96% of recieved utilization

and no ip is configured on this . There are 7-8 VSs like checked vsenv 7--> eth1-06.2781 like this different VLANs interfaces belong

to different VSs.

Re: Interface utilization is going 98% (recieved) in the VSX gateway

Kaspars_Zibarts — Tue, 07 Jul 2020 15:54:23 GMT

Very basic, but have you tried tcpdump, often enough you can see high bandwidth users from tcpdump. Just explicitly set good flags to stop the capture and not to saturate CPU. I.e count, -c xxx

Re: Interface utilization is going 98% (recieved) in the VSX gateway

vikupoi_123 — Sat, 11 Jul 2020 20:18:28 GMT

Hi Kaspers ,
Thanks for confirmation
What will be tcpdump command to identify high bandwidth users ?

Re: Interface utilization is going 98% (recieved) in the VSX gateway

Maarten_Sjouw — Sat, 11 Jul 2020 20:59:14 GMT

You can always look with cpview to see if you can find the top network users.
The tcpdump command would be something like:
tcpdump -i eth1-06 -c 1000
to capture a max of 1000 packets.
Make sure the scrollback buffer from your SSH program is set big enough to scroll back through those lines.

Re: Interface utilization is going 98% (recieved) in the VSX gateway

vikupoi_123 — Mon, 13 Jul 2020 13:11:34 GMT

Hi Kaspers ,
But how we can identify which host or servers is taking most bandwidth or most packets like "ip accounting " in cisco ?

Re: Interface utilization is going 98% (recieved) in the VSX gateway

Timothy_Hall — Mon, 13 Jul 2020 14:19:22 GMT

See the VSX-specific sections of these SK's, the short answer is you have to use CPMonitor:

sk164215: How to Detect and Handle Heavy Connections

sk122013: Handling heavy connections in CoreXL

sk167553: Performance Investigation Procedure - How To

Re: Interface utilization is going 98% (recieved) in the VSX gateway

Magnus-Holmberg — Mon, 13 Jul 2020 14:32:40 GMT

If its alot of sessions its possible to check the top sources/top destinations within the smartlog. it have helped me from time to time. dosn´t really say high bandwidth just number of sessions.

Regards
Magnus

Re: Interface utilization is going 98% (recieved) in the VSX gateway

vikupoi_123 — Mon, 13 Jul 2020 15:27:59 GMT

Hi Magnus ,
If we want to find the top source and destinations in interface wise . Can we do it through smartLog ?

Re: Interface utilization is going 98% (recieved) in the VSX gateway

Magnus-Holmberg — Mon, 13 Jul 2020 16:03:44 GMT

well you do have the routing table/antispoofing so just filter on those prefixes(networks) first then smartlog will do new calculation on top source and destinations.

Regards,
Magnus

Re: Interface utilization is going 98% (recieved) in the VSX gateway

Wolfgang — Mon, 13 Jul 2020 20:33:39 GMT

How about using SmartviewMonitor and looking for top source, destination or service on the interface ?

Wolfgang