cancel
Showing results for 
Search instead for 
Did you mean: 
Create a Post

R80.x Performance Tuning and Debug Tips – TCPDUMP vs. CPPCAP

What is CPPCAP?


TCPDUMP is a Linux tool which at times is not suitable for use with Gaia. Running TCPDUMP causes a significant increase in CPU usage and as a result impact the performance of the device. Even while filtering by specific interface or port still high CPU occurs. Check Point created a tool which works better with Gaia OS.

Chapter

More interesting articles:

- R80.x Architecture and Performance Tuning - Link Collection
- Article list (Heiko Ankenbrand)

CPPCAP

Tip 1 

"CPPCAP" is a traffic capture tool which provides the most relevant outputs and is similar to Tcpdump. The tool is adjusted to Gaia operating system yet requires installation of an applicable RPM.

The good news! SecureXL can be enabled or disabled to capture with CPPCAP.

You can download this tool for R77.30, R80.10 and R80.20. Get more details here: sk141412

Instal and use:

  1. Download the RPM package (sk141412) and transfer the RPM package with winscp to appliance or open server.
  2. Install the RPM using the following command:
    # rpm -ivh --force --nodeps <RPM_FILE>
    # /etc/init.d/start_cppcap start
  3. Start cppcap to sniffing packages (for example on interface eth0 with parameter "N"):

    On internal Interface (example "ping 8.8.8.8" from client IP 10.1.2.1 to server IP 8.8.8.8)
    :
    #
    cppcap -i eth0 -N  |grep ICMP

        On external Interface:

        # cppcap -i eth2 -N  |grep ICMP

Notes:

- To have all verbos information add "-DNT" to the syntax to filter out specific interface or VS by using capital letters.
- It will provide outputs on ARP IPV4/IPV6, TCP and UDP traffic. Dynamic routing information will not show all verbose information.

Tip 2

In and out (see red marked point in picture):

In       - Is the incoming packet on the firewall on the inbound interface from the point of view of the first packet. It is simalary to fw monitor inspection point "i" client to server packet.

Out    - Is the outgoing packet on the firewall on the inbound interface from the point of view of the first packet. It is simalary to fw monitor inspection point "O" server to client packet.

On the outgoing interface (see blue marked point in picture), the view is exactly inverse.

Tip 3

Flag Explanation
 -vV VSID                    lowercase to capture only from specific VSID, uppercase for all exec pt VSID
 -iI DEVICE  lowercase to capture only from specific DEVICE, uppercase for all execpt DEVICE         
 -d DIR  capture specific direction ('in' for inbound, 'out' for outbound)
 -f "EXPR"  filter specific expression, for syntax, see pcap-filter(7)
 -o FILE  save capture to a FILE
 -c NUM  capture up to NUM bytes of frame (default 96, '0' for any size)
 -p NUM  capture NUM frames before stopping
 -b NUM  capture NUM bytes before stopping
 -D  verbose datalink layer
 -N  verbose network layer
 -T  verbose transport layer
 -Q  omit time from output

Copyright by Heiko Ankenbrand  1994-2019

6 Replies
Maik_H_
Iron

Re: R80.x Performance Tuning and Debug Tips – TCPDUMP vs. CPPCAP

Will this integated in the next jumbo hotfix for R80.10, R77.30?

Highlighted

Re: R80.x Performance Tuning and Debug Tips – TCPDUMP vs. CPPCAP

great

Re: R80.x Performance Tuning and Debug Tips – TCPDUMP vs. CPPCAP

FYI: As said in https://community.checkpoint.com/thread/10595-new-tool-cppcap the CPPCAP tool cannot be run on 32 bit systems, only on 64 bit systems.

Currently this is not written in the sk141412 

Update 11/12: SK team modified the SK, under solution it is now stated: "Note: The tool is supported only on 64 bit OS."

Re: R80.x Performance Tuning and Debug Tips – TCPDUMP vs. CPPCAP

GREAT JOB!

Re: R80.x Performance Tuning and Debug Tips – TCPDUMP vs. CPPCAP

Interresting information.

Is it also with fw monitor?

0 Kudos

Re: R80.x Performance Tuning and Debug Tips – TCPDUMP vs. CPPCAP

Great post!

After installing the RPM, trying to start it causes an error. why is that?

# rpm -ivh --force --nodeps /home/admin/Check_point_R80.20_cp_pcap_sk141412.rpm
Preparing... ########################################### [100%]
1:cp_pcap ########################################### [100%]
# /etc/init.d/start_cppcap start
insmod: error inserting '/lib/modules/cppcap/cppcap_kern_64.o': -1 Unknown symbol in module
Failed to find major number for cppcap

 

0 Kudos