FW monitor -F syntax

[FrozT]

I don't understand why they nerf'd 'fw monitor -e' in favor of 'fw monitor -F'?  My opinions aside ノಠ_ಠノ, how do we convert old syntax such as this:

fw monitor -e "accept net(13.64.0.0,11) and host(10.0.0.1);"

how do I do that with -F?

[Danny]

You don't. -F is a simple capture filter that relies on Kernel Debug filters and doesn't support supernetting. However, it supports using wildcards.

So you have two options:

1. fw monitor -F "10.0.0.1,0,13.*.*.*,0,0" -F "13.*.*.*,0,10.0.0.1,0,0"
2. fwaccel off; fw monitor -e "accept net(13.64.0.0,11) and host(10.0.0.1);"; fwaccel on

[FrozT]

Option 1 is not the same thing and option 2 isn't really an option because fw monitor -e doesn't work anymore regardless if acceleration is turned on or off.  It will not filter anything and instead spit back what I can only guess is all the traffic.

So basically Checkpoint has removed one of the best troubleshooting methods and that's that.  I can't believe that they've taken fw monitor away from us...

[Timothy_Hall]

fw monitor -F "10.0.0.1,0,13.*.*.*,0,0" -F "13.*.*.*,0,10.0.0.1,0,0"

This syntax doesn't seem to work correctly for me, as an example this works as expected:

fw monitor -F 4.2.2.2,*,*,*,* -F 0,0,4.2.2.2,0,0

However this next one doesn't install a filter at all, and just gives me everything unfiltered:

fw monitor -F 4.2.2.*,*,*,*,* -F 0,0,4.2.2.2,0,0

I've noticed that if you typo the -F filter it doesn't error out but just gives you everything unfiltered which is a bit dangerous in my opinion.  Example:

fw monitor -F totalgarbage

I get every possible packet unfiltered, it even says "Compiled OK".  Huh?

[Danny]

Right, that's another reason such complex tools should always come with a user interface that performs syntax checking. Such as my FW Monitor SuperTool. If I'd only find the time to add -F simple capture syntax support to it. Currently my entire free time is taken by Check Points CoreXL team to advance my CoreXL Dynamic Balancing extension to fully control the Dynamic Split via SmartConsole.