Checkpoint R80.10 does not show correctly connection table

[minhhaivietnam]

Hello all,

I have a Firewall running R80.10

I see connection table by command "fw ctl conntab | grep 55195"

It shows that status is SYN_ACK, meaning that the TCP session is not established yet.

But when I run tcpdump command , the result show that: data is already transfering normally , meaning that TCP session is successfully established. 

So why ??

Thank for replying.

Brs,

Hainm

[PhoneBoy]

I suspect that fw ctl conntab is showing the regular connections table and this particular connection is accelerated with SecureXL, which has a related, but different connections table.