Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Danny_Philipse
Explorer
Jump to solution

fw monitor shows additional chain position e

In fw monitor I am used to see only the chain positions i I o O.

Now I have seen also the chain position  e in my ouput.

I have never seen it before. I use fw monitor with filter on src and dst.

The traffic is supposed to go over the IPsec VPN begind interface eth1-01.

Because I am facing issues I want to make sure if this is relevant.

I run R80.10 JHF 56 clean install,

fw monitor -e 'accept src=10.1.1.1 and dst=8.8.8.8;'

[vs_0][fw_0] eth2.2022:i[60]: 10.1.1.1 -> 8.8.8.8 (ICMP) len=60 id=25411
ICMP: type=8 code=0 echo request id=18 seq=32331
[vs_0][fw_0] eth2.2022:I[60]: 10.1.1.1 -> 8.8.8.8 (ICMP) len=60 id=25411
ICMP: type=8 code=0 echo request id=18 seq=32331
[vs_0][fw_0] eth1-01:o[60]: 10.1.1.1 -> 8.8.8.8 (ICMP) len=60 id=25411
ICMP: type=8 code=0 echo request id=18 seq=32331
[vs_0][fw_0] eth1-01:O[60]: 10.1.1.1 -> 8.8.8.8 (ICMP) len=60 id=25411
ICMP: type=8 code=0 echo request id=18 seq=32331
[vs_0][fw_0] eth1-01:e[60]: 10.1.1.1 -> 8.8.8.8 (ICMP) len=60 id=25411
ICMP: type=8 code=0 echo request id=18 seq=32331
monitor: caught sig 2
monitor: unloading

Thanks for your time in advance.

1 Solution

Accepted Solutions
2 Replies
Vladimir
Champion
Champion
HeikoAnkenbrand
Champion Champion
Champion

SecureXL "fwaccel off" does not have to be disabled on R80.20 to run "fw monitor". This is good for performance, so "fw monitor" does not affect performance any more.

Furthermore there are new fw monitor inspection points available:

More see here: R80.x Performance Tuning and Debug Tips – fw monitor 

Regards

Heiko

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events