Showing results for 
Search instead for 
Did you mean: 
Create a Post

Re: My Top 3 Check Point CLI commands

oh, seems I've missed that topic year ago ... Smiley Sad

every day usage of following:

watch --interval=1 'cpstat fw'
watch cphaprob stat

clusterXL_admin down -p
vsx stat - l
cphaprob -a if

clish> show routed cluster-state detailed
fw ctl affinity -l -v -r
fw ctl zdebug drop
fwaccel stats -s
fw tab -s -t connections
watch fw tab -s -t connections

curl_cli -v -k

fw monitor -e "host(x.y.z.w) and host(a.b.c.d), accept;"

tcptraceroute -4 -T -p 80 a.b.c.d

and obviously ntpq -pn Smiley Happy when we know time is precious  



Re: My Top 3 Check Point CLI commands

Despite having been started more than a year ago, this thread by far garners the most views of any thread on CheckMates to date.

It shows no signs of slowing down Smiley Happy


Re: My Top 3 Check Point CLI commands

yes mate, indeed it looks awesome also viewing your recent CPX '18 Youtube 25min. video Smiley Happy 

well done Dameon! keep it going same way and well done to all of YOU (US) contributors!  



Re: My Top 3 Check Point CLI commands

... and OBVIOUSLY in notorious way - awesome and only CPVIEW Smiley Happy

0 Kudos

Re: My Top 3 Check Point CLI commands

Check SIC & license status at GWY

  • cp_conf sic state
  • cplic check identity

Check identity awareness at GWY (in expert mode)

  • pdp monitor client_type portal      (show everyone who is authenticated via captive portal)
  • pdp monitor ip              (same as above but for a specific IP/user)
  • pdp control revoke_ip 

Re: My Top 3 Check Point CLI commands


cphaprob -a if

show cluster stats - a nice new one

Better late then never

0 Kudos

Re: My Top 3 Check Point CLI commands


0 Kudos

Re: My Top 3 Check Point CLI commands

Also to see which traffic is matched on what rule(s) you can use (in R80):


fw up_execute src=x.x.x.x dst=y.y.y.y ipp=17 dport=53 (run in expert mode)

Rulebase execution ended successfully.

Overall status:


Active clob mask: 0

Required clob mask: 0

Match status: MATCH

Match action: Accept


Per Layer:


Layer name: NAME

Layer id: 0

Match status: MATCH

Match action: Accept

Matched rule: 14

Possible rules:  14 18 19 16777215

Have fun!

Re: My Top 3 Check Point CLI commands

I like this command.

0 Kudos

Re: My Top 3 Check Point CLI commands

Thanks Timothy,

Yes, I agree that it indicates that I'm are running out of Hide NAT ports somewhere but I can't find any evidence that it's reaching the 50k limit or that it's for ports in the 60,001 to 65536 range. Traffic analysis on the external interface shows most connections are from source ports in the 30,000 to 39,999 range and the 40,000 to 49,999 range with peaks counts  of 500 to 600 unique ports in each of those two ranges. I record no connections from source ports in the 20,000 to 29,999 range and only the odd one connection in the 50,000 -59,999 range which is always port 50,001. However, there does seem to be a correlation between the NAT hide logs and a flurry of connections in the 10,000 to 19,000 range. Ports in this range are only seen when the issue occurs.

The traffic analysis shows that large ranges of ports are never used which would suggest that the 50k limit is never reached and, as said earlier, each time I've run the fw tab -u -t connections | grep -ci command, the result stays under 10,000 connections.  I don't think setting up a "many to fewer" hide NAT will do anything as the source is a single proxy IP and that NAT IP is dedicated to the Proxy IP and used only for one internet target IP.

Thanks again for your input - I didn't mean to hi-jack this thread/discussion with my issue. I'm going to try and escalate again through CheckPoint.


Re: My Top 3 Check Point CLI commands

fw ctl zdebug drop > drops.txt

cphaprob -a if

fw unloadlocal
0 Kudos

Re: My Top 3 Check Point CLI commands

cphaprob -a if


fw ctl zdebug + drop

0 Kudos

Re: My Top 3 Check Point CLI commands

My top CLI commands

Who using the most cpu

ps -eo pcpu,pid,user,args | sort -r -k1 | less

To remove a connection from the connection table

fw tab -t connections -u > table

IPA="1024"; IPB="1024"; IPAHEX=`printf '%02x' ${IPA//./ }`; IPBHEX=`printf '%02x' ${IPB//./ }`; grep "$IPAHEX" table | grep "$IPBHEX" | grep "^<0000000" | awk '{print $1" "$2" "$3" "$4" "$5" "$6}'|sed 's/ //g'|sed 's/</fw tab -t connections -x -e /g'|sed 's/>//g'|sed 's/;//g' > listall

cat listofall

fw tab -t connections -x -e 00000001,50a99963,000001f4,81231bc4,000001f4,00000011

fw tab -t connections -x -e 00000001,81231bc4,000001f4,50a99963,000001f4,00000011

fw tab -t connections -x -e 00000000,81231bc4,000001f4,50a99963,000001f4,00000011

fw tab -t connections -x -e 00000000,50a99963,000001f4,81231bc4,000001f4,00000011

Remote commands from CMA

`$CPDIR/bin/cprid_util -server $Firewall_IP -verbose rexec -rcmd /bin/clish -c


Identity Awareness

pdp monitor summary all

netstat -anp | grep wmic

pdp d rotate

adlog a d on

adlog a d extended

pdp debug on

pdp d s all all

adlog a control reconf;sleep 5;watch -n 1 -d "adlog a dc"

adlog a d off

pdp d unset all all

pdp d off

cat $FWDIR/log/pdpd.elg | grep -i

fw tab -t pdp_sessions -t pdp_super_sessions -t pdp_encryption_keys -t pdp_whitelist -t pdp_timers -t pdp_expired_timers -t pdp_ip -t pdp_net_reg -t pdp_net_db -t pdp_cluster_stat -t pep_pdp_db -t pep_networks_to_pdp_db -t pep_net_reg -t pep_reported_network_masks_db -t pep_port_range_db -t pep_async_id_calls -t pep_client_db -t pep_identity_index -t pep_revoked_key_clients -t pep_src_mapping_db -t pep_log_completion -x -y

fw kill pdpd

fw kill pepd


killing Zombies

To find a zombie process

ps aux | awk '"[Zz]" ~ $8 { printf("%s, PID = %d\n", $8, $2); }'

Kill a Zombie process run

kill -9 $(ps -A -ostat,ppid | grep -e '[zZ]'| awk '{ print $2 }')

running top again the counter for zombie should now be 0


0 Kudos