FW Monitor in VSX

[Matlu]

Hi Guys

Is it possible to run a "fw monitor" from the VS0 of a VSX Cluster environment?

I have several VS's, and I want to capture traffic from a particular VS (VS 5).

Is this possible, without having to "jump" to the instance?

Can you share with me the syntax of the command, how it could be done, based on the following example:

Source: 172.16.10.5
Destination: 10.100.20.10
Port: TCP 8080

Thanks

[the_rock]

fw monitor -v 0 -e accept "host 172.16.10.5 and host 10.200.20.10 and port 8080;"

[Matlu]

This applies if you are ‘standing’ on VS0 and want to capture traffic from VS 5?

[the_rock]

Just replace 0 with 5 🙂

[Matlu]

The command syntax varies greatly if you need to send the command result to a file such as Wireshark?

[the_rock]

Just add -o /path/filename.cap at the end

[Lesley · Accepted solution]

This is all you need:

https://tcpdump101.com/#

Under Check Point -> FW Monitor -> New version

[the_rock · Accepted solution]

There you go buddy 🙂

fw monitor -v 5 -o vs5.cap -F "172.16.10.5,0,10.100.20.10,8080,0"

Andy

[Matlu]

One doubt, is there much difference in the ‘fw monitor ...’ command between using the -e vs -F parameter?

Is one better than the other?

[the_rock]

Buddy,

Have a look at your own post 😉

Andy

https://community.checkpoint.com/t5/Security-Gateways/Traffic-capture-with-FW-MONITOR/m-p/245408

[Timothy_Hall]

Use -F if you can deal with the extremely limited matching syntax.  You will always get a complete capture regardless of the acceleration state of the traffic.

[Matlu]

Hello,
So, as a "best practice" it is always better to use the "-F" before the "-e"?
Greetings.

[Timothy_Hall]

I'd say so, there are still some limited situations where -e is needed instead but they are fairly obscure.  The upcoming CCTA R82 class is being heavily updated to explore packet capturing & analysis in detail, and it covers this very topic.

[the_rock]

For what its worth, I usually use -F flag and works real well.

Andy

[the_rock]

@Matlu Did command we shared work for you?

Andy