How to identify connection storm source?

[networksteamIMS]

Hi all,

I have an annoying issue happening regularly on certain days/time. Our network freezes for several few seconds intermittently during the time. Checked there is no job scheduled on the firewall, also no idea on which server(s) is/are making such.

Below is the cpview screen cap on one of the CPU core when we are experiencing the blips. Connections spikes from 3k to 2xk for few seconds and keep happening for around every 9mins for an hour or so also this happens across most of the CPU cores which causing them over 90-99% utilization.

As you may aware the "Top connections" section is not helping as they are just consuming very little cpu. What I wanna know is the huge numbers of the tiny connection which not showing in the elephant report.

Is there any command which can show the real time connection table (source and destination) or any other proper way to get to the bottom of it?

Regards,

Bill.

[simonemantovani · Accepted solution]

Hello

you could try the following script https://community.checkpoint.com/t5/Scripts/ECONN-Easy-Connection-Table-Tool-v6-9/m-p/255399 written by @HeikoAnkenbrand 

[networksteamIMS]

@simonemantovani @HeikoAnkenbrand LEGEND!!!!!!!!!! You are my hero!! 

[Timothy_Hall]

Yup, a great tool that made it into Max Power 2026.