'fw ctl conntab -x' issue in R81.10

[HeikoAnkenbrand]

From R81 it is possible to delete all sessions matching the filter with the command "fw ctl conntab -x ".

Unfortunately, this does not work for the "rule" filter. Here the complete connection table is deleted 😞

For example:

fw ctl conntab -x -rule=3

Tested with R81.10.

---

fw ctl conntab -h

Usage:
-h/-help # Display this help menu
-x # Delete the selected entries (without this flag, entries are only printed)
-sport # Filter by source port or source port range
-dport # Filter by destination port or detination port range
-proto # Filter by IP protocol or IP protocol range
-sip # Filter by source IP or source IP range
-dip # Filter by destination IP or detination IP range
-rule # Filter by rule or rule range
-service # Filter by service
-type # Filter by type bitmask
-flags # Filter by flags bitmask
-state # Filter by TCP state (SYN_SENT, SYN_ACK, ESTABLISHED, SRC_FIN, DST_FIN, BOTH_FIN)
Using multiple options will display only entries that match both criteria (x AND y)

Usage Examples:
* Display / Delete all port 80 connections in state BOTH_FIN:
fw ctl conntab [-x] -state=BOTH_FIN -dport=80
* Display / Delete all connections from 192.168.X.X:
fw ctl conntab [-x] -sip=192.168.0.0-192.168.255.255
* Display / Delete all old connections:
fw ctl conntab [-x] -flags=0x100/0x100

[HeikoAnkenbrand]

Any news in this case from Check Point?

[Ilya_Yusupov]

Hi @HeikoAnkenbrand ,

can you share if you got any error message?

[shais]

Hi,
We are not aware of this issue and are unable to reproduce this in our setup.

Can you please open a ticket with support? this will allow us to get all the required info and do a remote session

[G_W_Albrecht]

Seems to be fixed in R81.20:

fw ctl conntab -x -rule=3

deletes only the rule 3 connections

[HeikoAnkenbrand]

If you delete the connection in the connection table, it is still contained in the acceleration table and in the Dynamic Dispatcher table. Therefore, you may have some negative effects.

After deletion, they were still contained in the following tabel:

fw ctl multik gconn -p      -> Dynamic Dispacher tabel
fwaccel conns                    -> Acceleration tabel

Personally, I would be very careful about deleting the connetions.

---

Maybe Check Point's R&D can say something about this topic.

[G_W_Albrecht]

Very true - but the rule filter works now...