Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted

How to determine top talker host IP

Jump to solution

Want to determine top talker host in checkpoint via cli. Any idea how?

OS: IPSO Kernel Ver. 4.2

2 Solutions

Accepted Solutions
Highlighted

Source IP Top 10

fwaccel conns | awk '{print $1}' | sort | uniq -c | sort -n -r | head -n 10

 Destination IP Top 10

fwaccel conns | awk '{print $3}' | sort | uniq -c | sort -n -r | head -n 10

 

View solution in original post

Tags (1)
Highlighted

You can also use "fw tab -t connections -u -f" and change the parameter for the "print $x" command.

View solution in original post

Tags (1)
6 Replies
Highlighted

Assuming SecureXL (flows) is enabled, you should be able to use the Top Talkers script by @Craig_Dods, not sure if it will work on IPSO but worth a try:

http😕/expert-mode.blogspot.com/2013/05/checkpoint-top-talkers-script-display.html

 

Book "Max Power 2020: Check Point Firewall Performance Optimization" Third Edition
Now Available at www.maxpowerfirewalls.com
Highlighted
Admin
Admin

IPSO 4.2 implies you're running R65 or earlier, which hasn't been supported for quite a while. Pretty sure there is no facility for this in those releases. You might be able to write a script to parse the connections table to see who the top talker is "right now."

SmartView Monitor may be an option assuming you have a license for it and it runs on IPSO (don't remember if it's supported or not). Otherwise, you'd have to parse the logs to figure this out.

Highlighted

Source IP Top 10

fwaccel conns | awk '{print $1}' | sort | uniq -c | sort -n -r | head -n 10

 Destination IP Top 10

fwaccel conns | awk '{print $3}' | sort | uniq -c | sort -n -r | head -n 10

 

View solution in original post

Tags (1)
Highlighted

You can also use "fw tab -t connections -u -f" and change the parameter for the "print $x" command.

View solution in original post

Tags (1)
Highlighted

Appreciate it! Thanks

Highlighted
Copper

You can use Smartview Monitor from the CLI with rtm monitor.

For example:

# rtm monitor -k src -v wb sort=top -i 60

Will give you an output every 60 seconds of top source addresses.