id = 0 in fwmonitor

[Marquevis]

Hey guys,

I was using fwmonitor and I came across some information.

What does id = 0 mean in the fwmonitor utility?

I know it shows the packet's sequence number, but does the zero have any meaning?

 

[the_rock]

Below might answer your question

https://community.checkpoint.com/t5/General-Topics/id-ID-and-OE-inspection-points-in-R80-20-GA/td-p/...

[Timothy_Hall]

While it is possible to have a capture point of id (inbound before decrypt), the field you have circled in your screenshot is the IP Layer 3 header field "Identification", not the Layer 4 TCP sequence number.  The IP ID field is supposed to be unique for each individual packet associated with a single connection (srcip,sport,dstip,dport) in order to support fragmentation and reassembly.  All fragments of the same datagram will have an identical IP ID, and as such the reassembling system can put them back together. 

However if the DF (Don't fragment) bit is set, fragmentation is not allowed and the IP ID is irrelevant.  The most common type of traffic that has DF set in my experience is ESP/IPSec.  I suspect that the DF bit is set in those packets you captured, and that is why the IP ID was left as 0 by the sending system because it simply doesn't matter. 

Here is a diagram from my Max Capture video series identifying the IP ID field, which by default is only shown from the CLI when using fw monitor.  I would speculate that the reason fw monitor shows this field by default in CLI output is because the same packet is displayed many times at the various capture points, and the IP ID can be a handy visual reference to verify that several lines of output are actually the same packet, since the multiple lines for a single packet will all have the same IP ID.  Also possible that fw monitor shows the IP ID because traffic displayed by fw monitor has already been virtually reassembled if fragmentation is present, whereas tcpdump and cppcap will just show you the original fragments instead.