cli logs

[ebinva]

Hi all,

I need syntax of the command , which provide complete details of traffic flow including details of tcp state, inbound and outbound,rule name, service , conn module details on checkpoint firewall live logs for tcpdump or Fw monitor.

[_Val_]

This is probably more than a single command. Also, logs are usually sent to the management and handled there. 

Can you elaborate on your usecase?

[ebinva]

there is a traffic between particular source and destination on specific port, we need to check inbound and outbound traffic flow of packet with details of tcp details, connect status ,rule for accepting or rejecting etc.

[the_rock]

So for rule accepting, you can use below examples:

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_CLI_ReferenceGuide/Topics-CLIG/FWG...

For traffic itself, try something like below and -F flag can be used as many times as you like.

fw monitor -F "1.1.1.1,0,2.2.2.2,4434,0" -F "2.2.2.2,0,1.1.1.1,4434,0"

In that example, 1.1.1.1 is src, 2.2.2.2 is dst and logic is like this:

src ip, src port, dst ip, dst port, protocol

Andy

[Bob_Zimmerman]

Pretty sure you can only provide up to five -F flags. Also, I'm not aware of any way to do partial matches (e.g, to match a source network), only an exact value or a whole-field wildcard, so it's easy to burn through those five when troubleshooting all but the most trivial flows.

[the_rock]

Thanks Bob, thats good to know. I thought it was as many -F flags as you needed.

Andy

[the_rock]

As Val said, definitely more than a single command.

Andy