topic Re: fw monitor shows additional chain position e in General Topics

fw monitor shows additional chain position e

Danny_Philipse — Tue, 06 Feb 2018 08:44:25 GMT

In fw monitor I am used to see only the chain positions i I o O.

Now I have seen also the chain position e in my ouput.

I have never seen it before. I use fw monitor with filter on src and dst.

The traffic is supposed to go over the IPsec VPN begind interface eth1-01.

Because I am facing issues I want to make sure if this is relevant.

I run R80.10 JHF 56 clean install,

fw monitor -e 'accept src=10.1.1.1 and dst=8.8.8.8;'

[vs_0][fw_0] eth2.2022:i[60]: 10.1.1.1 -> 8.8.8.8 (ICMP) len=60 id=25411
ICMP: type=8 code=0 echo request id=18 seq=32331
[vs_0][fw_0] eth2.2022:I[60]: 10.1.1.1 -> 8.8.8.8 (ICMP) len=60 id=25411
ICMP: type=8 code=0 echo request id=18 seq=32331
[vs_0][fw_0] eth1-01:o[60]: 10.1.1.1 -> 8.8.8.8 (ICMP) len=60 id=25411
ICMP: type=8 code=0 echo request id=18 seq=32331
[vs_0][fw_0] eth1-01:O[60]: 10.1.1.1 -> 8.8.8.8 (ICMP) len=60 id=25411
ICMP: type=8 code=0 echo request id=18 seq=32331
[vs_0][fw_0] eth1-01:e[60]: 10.1.1.1 -> 8.8.8.8 (ICMP) len=60 id=25411
ICMP: type=8 code=0 echo request id=18 seq=32331
monitor: caught sig 2
monitor: unloading

Thanks for your time in advance.

Re: fw monitor shows additional chain position e

Vladimir — Tue, 06 Feb 2018 13:59:04 GMT

Please see this thread:

https://community.checkpoint.com/message/11636-re-fw-monitor-inspection-point-e-or-e?commentID=11636#comment-11636

Re: fw monitor shows additional chain position e

HeikoAnkenbrand — Sun, 18 Nov 2018 20:04:33 GMT

SecureXL "fwaccel off" does not have to be disabled on R80.20 to run "fw monitor". This is good for performance, so "fw monitor" does not affect performance any more.

Furthermore there are new fw monitor inspection points available:

More see here: R80.x Performance Tuning and Debug Tips – fw monitor

Regards

Heiko