topic Re: 'fw ctl conntab -x' issue in R81.10 in General Topics

'fw ctl conntab -x' issue in R81.10

HeikoAnkenbrand — Sun, 29 Aug 2021 13:24:29 GMT

From R81 it is possible to delete all sessions matching the filter with the command "fw ctl conntab -x ".

Unfortunately, this does not work for the "rule" filter. Here the complete connection table is deleted 😞

For example:

fw ctl conntab -x -rule=3

Tested with R81.10.

---

fw ctl conntab -h

Usage:
-h/-help # Display this help menu
-x # Delete the selected entries (without this flag, entries are only printed)
-sport # Filter by source port or source port range
-dport # Filter by destination port or detination port range
-proto # Filter by IP protocol or IP protocol range
-sip # Filter by source IP or source IP range
-dip # Filter by destination IP or detination IP range
-rule # Filter by rule or rule range
-service # Filter by service
-type # Filter by type bitmask
-flags # Filter by flags bitmask
-state # Filter by TCP state (SYN_SENT, SYN_ACK, ESTABLISHED, SRC_FIN, DST_FIN, BOTH_FIN)
Using multiple options will display only entries that match both criteria (x AND y)

Usage Examples:
* Display / Delete all port 80 connections in state BOTH_FIN:
fw ctl conntab [-x] -state=BOTH_FIN -dport=80
* Display / Delete all connections from 192.168.X.X:
fw ctl conntab [-x] -sip=192.168.0.0-192.168.255.255
* Display / Delete all old connections:
fw ctl conntab [-x] -flags=0x100/0x100

Re: 'fw ctl conntab -x' issue in R81.10

HeikoAnkenbrand — Sun, 12 Sep 2021 17:41:10 GMT

Any news in this case from Check Point?

Re: 'fw ctl conntab -x' issue in R81.10

Ilya_Yusupov — Mon, 13 Sep 2021 06:33:18 GMT

Hi @HeikoAnkenbrand ,

can you share if you got any error message?

Re: 'fw ctl conntab -x' issue in R81.10

shais — Mon, 13 Sep 2021 07:45:29 GMT

Hi,
We are not aware of this issue and are unable to reproduce this in our setup.

Can you please open a ticket with support? this will allow us to get all the required info and do a remote session

Re: 'fw ctl conntab -x' issue in R81.10

G_W_Albrecht — Wed, 01 Feb 2023 08:26:08 GMT

Seems to be fixed in R81.20:

fw ctl conntab -x -rule=3

deletes only the rule 3 connections

Re: 'fw ctl conntab -x' issue in R81.10

HeikoAnkenbrand — Wed, 01 Feb 2023 09:00:32 GMT

If you delete the connection in the connection table, it is still contained in the acceleration table and in the Dynamic Dispatcher table. Therefore, you may have some negative effects.

After deletion, they were still contained in the following tabel:

fw ctl multik gconn -p -> Dynamic Dispacher tabel
fwaccel conns -> Acceleration tabel

Personally, I would be very careful about deleting the connetions.

---

Maybe Check Point's R&D can say something about this topic.

Re: 'fw ctl conntab -x' issue in R81.10

G_W_Albrecht — Wed, 01 Feb 2023 09:04:44 GMT

Very true - but the rule filter works now...

Re: 'fw ctl conntab -x' issue in R81.10

Zolo — Sun, 27 Jul 2025 09:15:23 GMT

Hello,

I have a question regarding the following: in the output of the command "fw ctl multik gconn -p", there are some connections that have been present for several days, even though they no longer appear in the current connection table.
No connections were removed manually.

Have you encountered this issue before?
Is there a way to remove these entries from the gconn table without a reboot?

BR,

Zolo

Re: 'fw ctl conntab -x' issue in R81.10

Timothy_Hall — Sun, 27 Jul 2025 14:24:42 GMT

Totally different command, please start a new thread. On a firewall, there are actually three separate tables tracking "connections":

fw ctl multik gconn - Dynamic Dispatcher table on SND cores to ensure the packets of a connection are always "stuck" to the same Firewall Worker Instance. These connections may not necessarily be "alive"; it is just tracking a Firewall Worker Instance core assignment

fwaccel conns - SecureXL's connections table on SND cores for tracking live connections in the fastpath and medium path only

fw tab -t connections & fw ctl conntab - Table for tracking all live connections on the Firewall Worker Instances

Re: 'fw ctl conntab -x' issue in R81.10

Zolo — Sun, 27 Jul 2025 19:45:46 GMT

Thank you Timothy.
I opened a new thread: Dynamic Dispatcher table - Check Point CheckMates