topic Re: New Tool: CPPCAP in General Topics

New Tool: CPPCAP

PhoneBoy — Fri, 30 Nov 2018 18:40:17 GMT

TCPDUMP is a Linux tool which at times is not suitable for use with Gaia.

Specifically, it can use a noticeable amount of CPU.

Check Point created a tool which works better with Gaia OS: CPPCAP

'CPPCAP' is a traffic capture tool which provides the most relevant outputs and is similar to Tcpdump.

The tool is adjusted to Gaia operating system yet requires installation of an applicable RPM.

You can download this tool for R77.30, R80.10, and R80.20 and get more details here: Running TCPDUMP causes high CPU usage

Re: New Tool: CPPCAP

HeikoAnkenbrand — Fri, 30 Nov 2018 19:02:43 GMT

Hi Dameon,

Must SecureXL disabeld (fwaccel off) to use this tool with R80.20?

And how‘s that with R80.10 and R77.30?

Regards

Heiko

Re: New Tool: CPPCAP

Mike_A — Fri, 30 Nov 2018 19:21:28 GMT

Will this eventually be released to install via CPUSE?

*** EDIT ***

Just to add, I see the CPUSE Identifier in the SK, the question is about the publish of this update in CPUSE without having to use the identifier, just like other Recommended updates.

Thanks!

Re: New Tool: CPPCAP

PhoneBoy — Fri, 30 Nov 2018 20:35:44 GMT

Not that I know of.

Re: New Tool: CPPCAP

PhoneBoy — Fri, 30 Nov 2018 20:36:50 GMT

I assume we will push it as a recommended update after we get some good feedback

Re: New Tool: CPPCAP

Mike_A — Fri, 30 Nov 2018 21:04:06 GMT

One positive thing I've seen so far is the file size being included, not just the number of packets captured!

-bash-3.1# cppcap -DNT host 10.0.10.79 -o /var/tmp/mike.pcap
934 packets captured (75.719 KB)

Re: New Tool: CPPCAP

JozkoMrkvicka — Fri, 21 Jun 2019 09:02:16 GMT

https://community.checkpoint.com/thread/9013-tool-httpstcpdump101com

cc Sean Murray-Ford‌

Re: New Tool: CPPCAP

Grave_Rose — Sun, 02 Dec 2018 04:08:34 GMT

Thanks for tagging this for me, Jozko Mrkvicka‌ Looks like it's time to play around and add a new module. I'll get this going through the week (hopefully) and update the tcpdump101.com thread once it's done.

Re: New Tool: CPPCAP

Aviad_Hadarian — Sun, 02 Dec 2018 06:44:59 GMT

Heiko Ankenbrand‌, SecureXL can be enabled or disabled.

Re: New Tool: CPPCAP

Martin_Valenta — Mon, 03 Dec 2018 07:51:46 GMT

Is it planned to be pre-installed on newer version of ISO images ?

Re: New Tool: CPPCAP

_Jelle — Mon, 03 Dec 2018 08:28:59 GMT

Hi,

Looks like a nice tool... But its only for gateways that use a 64-bit Kernel...

Unsupported kernel version (Only 64-bit is supported)

Maybe this is worth mentioning in the discussion / SK

Regards,

Jelle

Re: New Tool: CPPCAP

PhoneBoy — Mon, 03 Dec 2018 15:49:34 GMT

Will ask the SK team to add this to the limitations.

That said, I would think 32-bit is rare at this point as 64bit is required to run with more than 4-6GB of RAM.

Re: New Tool: CPPCAP

Grave_Rose — Fri, 21 Jun 2019 09:02:18 GMT

I've added the 'cppcap' module to https://tcpdump101.com and updated the main Check Mates thread here https://community.checkpoint.com/thread/9013-tool-httpstcpdump101com for anyone who wants to discuss more.

Re: New Tool: CPPCAP

RickHoppe — Wed, 05 Dec 2018 13:44:40 GMT

Currently trying cppcap out on R80.10 JHF Take 167. I see only "Out" in my packet capture when SecureXL is turned off. When SecureXL is enabled I only see "In". So on pre-R80.20 machines the advise seems to be to turn off SecureXL when using cppcap.

Re: New Tool: CPPCAP

Robert_Canis — Thu, 06 Dec 2018 20:06:01 GMT

I've always used fw monitor over tcpdump.

What exactly does this new tool, or tcpdump get you over fw monitor?

Re: New Tool: CPPCAP

PhoneBoy — Thu, 06 Dec 2018 21:21:07 GMT

A couple of benefits:

You can actually save the packet captures
You can see traffic that doesn't traverse the firewall (i.e. broadcast or ARP traffic)

Re: New Tool: CPPCAP

Robert_Canis — Fri, 07 Dec 2018 12:56:11 GMT

you can save fw monitor captures with the -o option, so now we're down to just seeing broadcast traffic.

Re: New Tool: CPPCAP

Hugo_vd_Kooij — Mon, 10 Dec 2018 09:52:13 GMT

I have to upload a bunch of core dumps of the cppcap daemon.

Not sure what triggered them. I just noticed them when I did investigated something else.

Re: New Tool: CPPCAP

Harald_Hansen — Tue, 11 Dec 2018 08:53:42 GMT

Also ask them to fix the syntax error in the example ...

cppcap –f "arp and host XXX.XXX.XXX.XXX" -DNT –o /var/log/capture.pcap

Dash before the first 'f' and 'o'.

Edit: the text contains the dash, though on screen it is invisible (at least in Safari).

Re: New Tool: CPPCAP

Sean_Van_Loon — Tue, 11 Dec 2018 09:49:59 GMT

Received notification from SK team that SK has been modified: "Note: The tool is supported only on 64 bit OS."