Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Václav_Brožík
Collaborator

Limitations of cppcap

I wanted to try to use cppcap instead of tcpdump (on R80.20 + JHFA33) but I have encountered serious limitations which prevented me from using it on bridged interfaces:

  • cppcap is not capturing VLAN tagged frames! Only untagged frames are captured. When I use explicit filter "vlan" to capture only tagged frames - the capture is always empty.
  • Only "Out" direction was captured. "In" direction was working only on routed interfaces / interfaces with an IP address.

So on a gateway in bridge mode cppcap is almost completely unusable for me and I have to stay with good old tcpdump.

Are these limitations known? Are they going to be resolved? Did you encounter other limitations?

---

Otherwise cppcap has a great potential for becoming a very useful tool. Please consider supporting pcapng format and storing the interface and packet direction information into the capture file.

1 Reply
HeikoAnkenbrand
Champion Champion
Champion

Hi Václav,

you can found more informations here:

R80.x Performance Tuning and Debug Tips – TCPDUMP vs. CPPCAP 

I dont‘t use firewalls in bridge mode but I had the same issue in a bridge mode LAB environment.

I think it is an TAC theme.

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events