topic Re: Monitor mode and PCAP on Quantum Spark gateways in Spark Firewall (SMB)

Monitor mode and PCAP on Quantum Spark gateways

AntoinetteHodes — Wed, 11 Aug 2021 13:46:23 GMT

Traffic capture on a SPARK appliance with the tcpdump tool on a port configured in the Monitor mode (SPAN) shows only broadcast and multicast packets. By default, acceleration is enabled on the SPARK appliances. The acceleration module does not send the traffic it inspected to the tcpdump tool. To capture traffic on a monitor port's logical interface (brS-LAN<x>):

Configure all the applicable ports to work in monitor mode.
Connect to the command line on the SPARK appliance.
Log in to the Expert mode.
Run:

/opt/fw1/bin/cap_monitor_port.sh
Capture the traffic with the tcpdump tool.
To make this change persistent (to survive reboot), run this command in the Expert mode (do not change the syntax):

echo /opt/fw1/bin/cap_monitor_port.sh >> /pfrm2.0/etc/userScript

Notes:

This command is available starting from R80.20.20.
Traffic that is dropped by the Security Policy is not captured.

For more information, check out sk172286

Re: Monitor mode and PCAP on Quantum Spark gateways

RS_Daniel — Wed, 11 Aug 2021 13:36:18 GMT

Hello,

The shared link points to a wiki.checkpoint.com URL, but the domain is not being resolved by DNS:

> wiki.checkpoint.com
Servidor: dns.google
Address: 8.8.8.8

*** dns.google no encuentra wiki.checkpoint.com: Non-existent domain
>

And the sk number is present on supportcenter.checkpoint.com. So maybe you can fix the link.

Regards

Re: Monitor mode and PCAP on Quantum Spark gateways

AntoinetteHodes — Wed, 11 Aug 2021 13:46:55 GMT

Hi Daniel, it is fixed. Thanks