topic Re: fw ctl zdebug - yea or nay? in General Topics

fw ctl zdebug - yea or nay?

_Val_ — Sat, 18 Aug 2018 12:50:19 GMT

Hello everyone.

My position towards zdebug practice is known for quite some time. On every Troubelshooting course relivede I was explaining why I do not want my students to use fw ctl zdebug. Last year I have also published an article at my blog about this: CCMA's blog: Kernel debug Best Practices or "Why "fw ctl zdebug..." should not be used"

However, since this undocumented macros leaked out from Check Point R&D about 15 years ago, I see more and more people using it, and to my dismay, SK articles with this command.

So, to put the matter to rest, I want to check what you guys are thinking about this practice. Let's put it to the vote. The poll will be closing in two weeks from now.

Thanks for participating.

I use it all the time, with different flags and all. I like it	22
I only use "fw ctl zdebug drop" when I am on the hurry to fix a burning issue. I understand its limitations and agree it is to avoid	31
I never use it and I discourage others from using it.	3

Re: fw ctl zdebug - yea or nay?

HeikoAnkenbrand — Sat, 18 Aug 2018 15:13:07 GMT

I think there‘s a simple answer:

In lab environments - Yes

In production environments - No

I think it is a R&D tool for quick debugging.

You can found more infos in the following article:

"fw ctl zdebug" Helpful Command Combinations

PS: Valeri, there is a small typing issue „zdebud“ in the headline.

Regards,

Heiko

Re: fw ctl zdebug - yea or nay?

PhoneBoy — Sat, 18 Aug 2018 15:20:10 GMT

I fixed the typo at least

Re: fw ctl zdebug - yea or nay?

HeikoAnkenbrand — Sat, 18 Aug 2018 15:22:47 GMT

Regards

Heiko

Re: fw ctl zdebug - yea or nay?

_Val_ — Sat, 18 Aug 2018 15:43:39 GMT

thanks, missed that

Re: fw ctl zdebug - yea or nay?

_Val_ — Sat, 18 Aug 2018 15:44:58 GMT

you realized nobody reads the warning and gets straight into action after reading your piece? 🙂

Re: fw ctl zdebug - yea or nay?

_Val_ — Sat, 18 Aug 2018 15:47:17 GMT

Guess what, found another typo. Fixed also

Re: fw ctl zdebug - yea or nay?

Yuri_Slobodyany — Sun, 19 Aug 2018 08:21:06 GMT

I agree partly with Heiko Ankenbrand‌:

- In LAB environment - yes
- In production - yes

- As a SmartView Tracker replacement drop-in (to see if a rule drops the packet, who has time to open SmartConsole?) - yes

- Antispoofing/routing misconfiguration check - yes

Re: fw ctl zdebug - yea or nay?

Hugo_vd_Kooij — Mon, 20 Aug 2018 08:48:46 GMT

I use it slightly more then just with the drop option. But only if other means are not conclusive.

After all it IS a debug command and debugging takes up resources.

Re: fw ctl zdebug - yea or nay?

_Val_ — Mon, 20 Aug 2018 08:51:00 GMT

How about the buffer size?

Re: fw ctl zdebug - yea or nay?

HeikoAnkenbrand — Mon, 20 Aug 2018 11:19:32 GMT

It is a macro that executes the following commands:

fw ctl debug -buf 1024
fw ctl debug [The option behind "fw ctl zdebug"]
fw ctl kdebug -f
[Wait until CTRL+C is pressed]
fw ctl debug 0

So the buffer is not very large:-) I think that could be a problem with "fw ctl zdebug drop", too. Therefore, from my point of view, it's just for the lab environment.

Regards

Heiko

Re: fw ctl zdebug - yea or nay?

Jerry — Mon, 20 Aug 2018 11:20:23 GMT

+ drop with few specs afterwards but never in PROD 😉 Agree with all of you here all above. Awesome tool!

Re: fw ctl zdebug - yea or nay?

_Val_ — Mon, 20 Aug 2018 11:26:49 GMT

Hi, I assume Hugo knows that, hence the question 🙂

Re: fw ctl zdebug - yea or nay?

Maarten_Sjouw — Mon, 20 Aug 2018 18:12:58 GMT

Fully agree, just use it when needed, most of the times when Tracker/Smartlog does not show the traffic being dropped zdebug drop will.

Re: fw ctl zdebug - yea or nay?

_Val_ — Tue, 21 Aug 2018 07:54:39 GMT

Any proper debug will show you that. Are you familiar with fw ctl debug tool?

Re: fw ctl zdebug - yea or nay?

Petr_Hantak — Wed, 22 Aug 2018 06:50:38 GMT

I remember the article from Valeri Loukine‌ very well. Basically I agree with idea do not use it or only in limited environment, but still it is practical so:

In lab - yes I use it in more variations
In producition - yes I use it only "fw ctl zdebug drop" to quickly check dropped or antispoofing issued connections

Why we shows "fw ctl zdebug drop" to our colleagues on internal training sessions? Because it is easy to use. Especially when you have on-call specialist who should usually cover very large portfolio of different platforms in whole network area nowadays, you should give them quick&easy opportunity to check the issue.

Re: fw ctl zdebug - yea or nay?

_Val_ — Wed, 22 Aug 2018 08:48:28 GMT

Okay, here is my issue, right there. There is nothing quick&easy about kernel debug. That seems easiness is the main issue. Whoever does kernel debug, needs to understand the tool, the process and the implication. When encouraging people to use fw ctl zdebug, you show them a shortcut without explaining the mechanism.

Re: fw ctl zdebug - yea or nay?

Petr_Hantak — Wed, 22 Aug 2018 12:58:46 GMT

Yes with no doubt speaking about debug on Check Point it is not easy at all. You need understand so many things. What we are trying to do is try to explain the way to specialists, share background with them, warn them about limitation and impact. That is everything nice but if you are not working with Check Point every day and this is even not expect from everyone on the department, they remember less there 10% of knowledge that you shared. From on-call is expected to be superhero who is able to fix or start troubleshoot everything until TAC or relevant master guy is available. Plus when they are already wants to start debugs, everything is already in the fire. So still we share info that they can use it with risks and limitations and in case you are not sure what do you want or you are expect impact then "DO NOT USE IT!" and wait for relevant person.

It is not optimal for sure and possibly dangerous but during burning issue you have usually no time.

Re: fw ctl zdebug - yea or nay?

Yuri_Slobodyany — Thu, 23 Aug 2018 07:20:38 GMT

Actually a good point https://community.checkpoint.com/people/petr.1a4c7ef0-1799-4f26-8940-31a78579d64e - it greatly depends on the perspective, working for a Checkpoint Partner and taking care of hundreds of CP firewalls I forget that most IT folks work in Enterprises and need to debug once in a while one or few firewall boxes they have. In such cases playing with debug not fully understanding what you see can be indeed counterproductive - you can see 'problems' that do not exist or miss the ones that are actually there.

Re: fw ctl zdebug - yea or nay?

_Val_ — Thu, 23 Aug 2018 13:27:51 GMT

Petr, I used to run my troubleshooting course for the last 10 years. At the beginning of the course I always say: Check Point is simple, and we have three days to prove it. I stand by this even now. All you need is structure and understanding of architecture. Then it all falls into place.

It is better to explain how things are working than giving them hacks. fw ctl zdebug is one of those hacks.