- CheckMates
- :
- Products
- :
- General Topics
- :
- Re: Fw Monitor Command doesn´t show Virtual sys...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Fw Monitor Command doesn´t show Virtual system traffic
hello Guys! i´m having some issues troubleshooting a Site to Site VPN Traffic,
i have a Virtual system to all my Site to Site VPN on a cluster with r80.40 OS, both cluster gateways are 23500 series,
i need to check some specific incoming and outgoing traffic that pass trough a client´s Site to Site VPN,
The problem:
i can see traffic with the graphic interface named logs and monitor but only http and https traffic,
i´m doing a ping from the source (172.27.0.34) to destination (10.8.0.6) and i don´t see it, on logs and monitor
also the ping request don´t have any response ( timeout for this request)
the firewall have two virtual interfaces ( wrp256 to inside traffic and wrp257 to outside traffic) , i´m trying to use tcpdump on that interfaces and don´t show nothing ,
what i´m typing: (tcpdump -i wrp256 | grep 172.27.0.34) and (tcpdump -i wrp257 | grep 10.8.0.6)
i´m also trying to use:
fw monitor -v4 -F "172.27.0.34,0,10.80.6,0,0" and doesn´t work either (the command only shows my ssh connection to the active vsx gateway of the cluster = 10.1.250.246 is the active cluster gateway and 180.183.70.39 is my pc)
i think i´m doing something wrong when i´m typing the commands can you help me guys?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello @Albottini
You can try
fw monitor -v < VSID > -e < expression >
And
tcpdump -i wrp256 on one session
and
tcpdump -i wrp257 on another.
BR,
Kostas
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
"10.80.6" does not look like a valid IP to me. Should it be "10.8.0.6" instead?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Oliver is correct @KostasGR, you must specify a valid IP address in a fw monitor -F filter and cannot leave the last octet off hoping to match the first three octets, nor can you use CIDR notation (/24) nor any kind of wildcard like * or ?. Also keep in mind that ICMP traffic is never accelerated by SecureXL and will always go F2F.
However as noted in my Max Capture video series (the relevant page is below), tcpdump/cppcap won't usually give you a complete capture (or perhaps not even show any packets at all) when used on a Wrp interface due to a SecureXL feature called "warp jump". The recommendation for successfully capturing traffic on a Wrp interface according to the various SKs is to use "fw monitor", but those SKs do not specify whether to use the -e option (which captures inside F2F/INSPECT) or -F (which captures packets in sim/SecureXL).
I would think that fw monitor -F would show the packets you need on a Wrp interface if given a proper filtering syntax, but there is the possibility you'll need to to disable SecureXL completely (or exclude the desired traffic from SecureXL acceleration via steps in sk104468) and use fw monitor -e instead.
Exclusively at CPX 2025 Las Vegas Tuesday Feb 25th @ 1:00pm
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hello it was a typing error the ip is 10.8.0.6
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
where can i find a cppcap user guide ?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The main documentation is the SK for cppcap:
sk141412: Running tcpdump causes high CPU usage - Introducing cppcap
Beyond that the most extensive documentation would be my "Max Capture: Know your packets" self-guided video series which has lots of use cases, examples, and a compare/contrast with the other three capturing tools (tcpdump, fw monitor -e, and fw monitor -F).
Exclusively at CPX 2025 Las Vegas Tuesday Feb 25th @ 1:00pm
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
the ip is 10.8.0.6 it was a typing error
