Tcpdump + Zdebug

[kobilevi]

Hi Checkmates !

I wanted to know if Checkpoint has a complete guide to tcpdump and zdebug

Anyone know of one?
Thanks

[the_rock]

Can you explain please? What kind of guide? You can refer to below

https://gist.github.com/tuxfight3r/9ac030cb0d707bb446c7

[kobilevi]

hi

Hi I am looking for a complete guide for beginners to zdebug and tcpdump for checkpoint gateways 

[the_rock]

Just google it, bunch of links come up with useful flags.

[Oliver_Fink]

Maybe you want to use cppcap instead of tcpdump. Have a look at sk141412: cppcap - A Check Point Traffic Capture Tool…

It uses pcap-filter(7) as syntax and has no hassle with SecureXL.

[G_W_Albrecht]

tcpdump is not a CP software 😉

sk100808: How to use " fw ctl zdebug" command

sk30583: What is FW Monitor?

[Timothy_Hall]

You may want to check out my 2021 CPX presentation here which summarizes the packet capturing options on Check Point:

https://community.checkpoint.com/fyrhh23835/attachments/fyrhh23835/member-exclusives/484/2/CPX_Preso...

This presentation was derived from my self-guided video series "Max Capture: Know Your Packets" which thoroughly covers all the packet capture tools including tcpdump along with fw ctl zdebug + drop as well.  There are also free updates to the original class available here:

Max Capture Update 1: Taking "Triggered" Packet Captures

Max Capture Update 2: Debug Filter Battle -- fw monitor -F vs. fw ctl zdebug + drop

[PhoneBoy]

tcpdump: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...
fw ctl debug: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

[Vladimir_S]

tcpdump link is the broken.

Vlad.

[Chris_Atkinson · Accepted solution]

Note tcpdump isn't specific to check point.

We recommend using CPPCAP (sk141412) as an alternative 

[PhoneBoy]

Looks like an SK that isn't on the new Support Center as of yet.
I've reported this issue internally.
Meanwhile, you should be able to see it here: https://supportcenter.us.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&so...

[Blason_R]

Well there are bunch of ATRG available in support center. Those are more than enough to start with and then as suggested by community google can be your best friend. I specifically have learned using r&d on test setup.