Using FWMONITOR with SecureXL enabled (R80.20 and up) TechTip

tadams — Tue, 23 Jun 2020 19:46:11 GMT

Hello everyone,

I wanted to spread the knowledge that starting with R80.20 it is possible to packet capture with FWMONITOR with SecureXL turned on. I know it can sometimes be a hassle to troubleshoot traffic that can’t be seen with SecureXL acceleration. It can also be dangerous to turn it off because of the possibility of the non-accelerated traffic overpowering the CPU. In R80.20 and later traffic can be fully captured by fw monitor with SecureXL still enabled, as long as you use the -F flag along with an alternate traffic filtering syntax. Here is an example:

fw monitor -F 0,0,0,80,0

This equivalent fw monitor command can capture all destination port 80 traffic regardless of whether it is accelerated. You see there are five numeric positions in this syntax after the -F. Here are the meaning of them by positon.

Source IP
Source Port
Destination IP
Destination Port
Protocol

Hopefully this will be a help in your technical journeys!

Re: Using FWMONITOR with SecureXL enabled (R80.20 and up) TechTip

HeikoAnkenbrand — Tue, 23 Jun 2020 20:41:11 GMT

topic Re: Using FWMONITOR with SecureXL enabled (R80.20 and up) TechTip in General Topics

Using FWMONITOR with SecureXL enabled (R80.20 and up) TechTip

Re: Using FWMONITOR with SecureXL enabled (R80.20 and up) TechTip