fw monitor shows additional chain position e

[Danny_Philipse]

In fw monitor I am used to see only the chain positions i I o O.

Now I have seen also the chain position  e in my ouput.

I have never seen it before. I use fw monitor with filter on src and dst.

The traffic is supposed to go over the IPsec VPN begind interface eth1-01.

Because I am facing issues I want to make sure if this is relevant.

I run R80.10 JHF 56 clean install,

fw monitor -e 'accept src=10.1.1.1 and dst=8.8.8.8;'

[vs_0][fw_0] eth2.2022:i[60]: 10.1.1.1 -> 8.8.8.8 (ICMP) len=60 id=25411
ICMP: type=8 code=0 echo request id=18 seq=32331
[vs_0][fw_0] eth2.2022:I[60]: 10.1.1.1 -> 8.8.8.8 (ICMP) len=60 id=25411
ICMP: type=8 code=0 echo request id=18 seq=32331
[vs_0][fw_0] eth1-01:o[60]: 10.1.1.1 -> 8.8.8.8 (ICMP) len=60 id=25411
ICMP: type=8 code=0 echo request id=18 seq=32331
[vs_0][fw_0] eth1-01:O[60]: 10.1.1.1 -> 8.8.8.8 (ICMP) len=60 id=25411
ICMP: type=8 code=0 echo request id=18 seq=32331
[vs_0][fw_0] eth1-01:e[60]: 10.1.1.1 -> 8.8.8.8 (ICMP) len=60 id=25411
ICMP: type=8 code=0 echo request id=18 seq=32331
monitor: caught sig 2
monitor: unloading

Thanks for your time in advance.

[Vladimir · Accepted solution]

Please see this thread:

https://community.checkpoint.com/message/11636-re-fw-monitor-inspection-point-e-or-e?commentID=11636... 

[HeikoAnkenbrand]

SecureXL "fwaccel off" does not have to be disabled on R80.20 to run "fw monitor". This is good for performance, so "fw monitor" does not affect performance any more.

Furthermore there are new fw monitor inspection points available:

More see here: R80.x Performance Tuning and Debug Tips – fw monitor 

Regards

Heiko