topic Re: cppcap for GAiA Embedded in Spark Firewall (SMB)

cppcap for GAiA Embedded

G_W_Albrecht — Tue, 09 Jan 2024 13:15:35 GMT

sk141412: cppcap - A Check Point Traffic Capture Tool does not list Embeded GAiA as supported, and it is not pre-installed there as in GAiA since R80.40. Is cppcap supported in Embedded GAiA at all ?

Re: cppcap for GAiA Embedded

Lesley — Tue, 09 Jan 2024 14:51:49 GMT

As far as I know, it does not run it. If it is supported yes or no I cannot answers. But I know that tcpdump is still the way to go on embedded. For normal GAIA OS my preference is still old school tcpdump and I have never used cppcap to be honest. Also I see TAC still requesting tcpdump output(not cppcap) so not sure if this still the way to go.

Re: cppcap for GAiA Embedded

_Val_ — Tue, 09 Jan 2024 14:54:25 GMT

The answer is no. If you think it is a good idea to have cppcap on Embedded, please open an RFE

Re: cppcap for GAiA Embedded

Lesley — Tue, 09 Jan 2024 15:02:40 GMT

Btw the Tcpdump Tool in de webinterfaces -> Logs & monitoring -> Diagnostics -> Tcpdump Tool uses tcpdump in the background 🙂

psaux:

root 21818 0.0 0.0 7040 4224 ? S 16:00 0:00 tcpdump -t -q -nnn -c1000 -i any host 8.8.8.8

Re: cppcap for GAiA Embedded

G_W_Albrecht — Tue, 09 Jan 2024 15:03:18 GMT

cppcap is pre-installed since R80.40 (2018). On SMB i would prefer fw monitor for its filtering capabilities that are very valuable on the flash based appliances with little disk space...

Re: cppcap for GAiA Embedded

G_W_Albrecht — Tue, 09 Jan 2024 15:05:50 GMT

cppcap was made to use less CPU than tcpdump, so support on SMB would be a very good idea.

Re: cppcap for GAiA Embedded

Lesley — Tue, 09 Jan 2024 15:13:17 GMT

To be honest I don't want to compare fwmonitor with tcpdump (NAT,Routing etc). SMB indeed have little space, but you can increase it in a simple way, stick USB inside for more space. Or tcpdump with filter and / or let run for not to long.

If I check a random SMB I have around 15gb free in /logs and /storage, would be a real massive capture 😉

Re: cppcap for GAiA Embedded

Lesley — Tue, 09 Jan 2024 15:14:15 GMT

Smaller box, smaller traffic and therefore smaller capture 😉

Re: cppcap for GAiA Embedded

_Val_ — Wed, 10 Jan 2024 07:34:07 GMT

It is also optimized for a completely different kernel version and CPU type. Just saying...