topic Re: Maestro g_tcpdump performance impact? in Hyperscale Firewall (Maestro)

Maestro g_tcpdump performance impact?

HeikoAnkenbrand — Fri, 15 Oct 2021 12:03:10 GMT

In a Maestro environment with 100 GBit/s interfaces (uplink and downlink) and a high packet rate.

Can running g_tcpdump have a performance impact on the Maestro environment?

I think first yes, because all informations are forwarded into a ssh user session.

Can cppcap be used here as an alternative?

Is there any information on this from Check Point:
@Laszlo_Csosza @Anatoly

Re: Maestro g_tcpdump performance impact?

Timothy_Hall — Fri, 15 Oct 2021 09:26:52 GMT

cppcap was designed to help limit the performance impact on a firewall while taking a capture, so I'd imagine it would be preferable to tcpdump in your scenario. But let's ask the creator of cppcap, @Aviad_Hadarian.

Re: Maestro g_tcpdump performance impact?

HeikoAnkenbrand — Fri, 15 Oct 2021 09:34:08 GMT

Thanks @Timothy_Hall , I am aware of the information.
I need a statement for Maestro from Check Point, which is the best way to debug connections in real time without performance impact.

Re: Maestro g_tcpdump performance impact?

_Val_ — Fri, 15 Oct 2021 09:41:51 GMT

The best way to get an official statement from Check Point is to open a TAC case or to contact your local office.

That said, I understand that asking in the community is much more convenient 🙂

@Anatoly can you assist here?