topic fw monitor and cppcap on VSX R80.20 (JHF 91) in General Topics

fw monitor and cppcap on VSX R80.20 (JHF 91)

dj0Nz — Fri, 20 Sep 2019 13:27:36 GMT

I just want to share my findings on fw monitor and cppcap on a VSX R80.20 JHF 91 environment:

fw monitor just segfaults if I use the -v <VSID> switch
fw monitor just ignores the VS context if running without -v switch and captures packets in all VS
cppcap does not work in VSX R80.20 JHF 91 with acceleration enabled, I had to do a fwaccel off in the specific VS to capture traffic

I may be wrong. But if not, some documents should be corrected, including Heiko's excellent cheat sheet...

Re: fw monitor and cppcap on VSX R80.20 (JHF 91)

PhoneBoy — Sun, 22 Sep 2019 16:01:53 GMT

The first and third issues might be worth TAC cases.

Re: fw monitor and cppcap on VSX R80.20 (JHF 91)

Danny — Sun, 22 Sep 2019 19:18:58 GMT

@dj0Nz , this is all known. See..

Documented in sk162402
Documented in sk159152, either use the -F switch with simple capture syntax or disable SecureXL (for specific IPs if you like) before using -e
Documented here

Re: fw monitor and cppcap on VSX R80.20 (JHF 91)

dj0Nz — Mon, 23 Sep 2019 06:54:37 GMT

Thank you very much.

This would have helped a lot ... if sk162402 has been released earlier. Concerning the third topic: I would expect Check Point to include this in the official documentation, when it's certain that cppcap won't work with acceleration on.

But, again, thank you for clarifying!