cancel
Showing results for 
Search instead for 
Did you mean: 
Create a Post

IPS packet capture

Jump to solution

In R77.30 and earlier IPS packet capture was stored on the gateways as .pcap files and we could retrieve them using "fwm getpcap" over SSH. In R80+, IPS has been moved to Threat Prevention and it seems that packet capture is now being stored as .EML files. Looking at the logs from "fw log", the "packet_capture_unique_id" is now a name, where on earlier versions this was a ID number. Tried running "fwm getpcap" with different ID's from the logs, but all returning errors.

I heard that there are plans to stop using .EML files, but until then, are there any ways to get the IPS packet captures out from SSH?

1 Solution

Accepted Solutions
Employee
Employee

Re: IPS packet capture

Jump to solution

I don't know if this is too late, but maybe sk120773 helps:

IPS packet captures are located on on the Security Gateway in:

  • Before R80.x - $FWDIR/log/captures_repository 
  • In R80.10 - $FWDIR/log/forensics and /var/log/spool/mail/
9 Replies
Admin
Admin

Re: IPS packet capture

Jump to solution

Hm... good question.

Let me ping my friends in R&D about this one.

0 Kudos
Admin
Admin

Re: IPS packet capture

Jump to solution

Turns out that’s in R80.10+, the packet captures are stored on the log server, not the gateway as was the case in R77.30 and earlier.

Consequentially, the fwm getpcap command does not work for R80.10+ Gateways

An API for this is planned in R80.20.

Also, in R80.20, we plan to make the pcap available as a pcap (not EML).

Meanwhile, in R80.10, the only way to get the capture is via SmartConsole.

Re: IPS packet capture

Jump to solution

Thanks, will await for R80.20 then

0 Kudos
Highlighted

Re: IPS packet capture

Jump to solution

Did the ability to pull pcaps from the API make it into the R80.20 EA?

0 Kudos
Admin
Admin

Re: IPS packet capture

Jump to solution

I don't see anything in the API docs for it offhand...

0 Kudos
Employee
Employee

Re: IPS packet capture

Jump to solution

I don't know if this is too late, but maybe sk120773 helps:

IPS packet captures are located on on the Security Gateway in:

  • Before R80.x - $FWDIR/log/captures_repository 
  • In R80.10 - $FWDIR/log/forensics and /var/log/spool/mail/
Admin
Admin

Re: IPS packet capture

Jump to solution

Never too late for a correct answer Smiley Happy

The nice thing is in R80.10, these files are stored as .cap files directly, which means Wireshark and other tools can read them.

0 Kudos

Re: IPS packet capture

Jump to solution

In a R80.10 installation it seems that there is only .cap files for the last couple of days. Does anyone know for how long the .cap files are stored and where it can be configured?

0 Kudos
Employee
Employee

Re: IPS packet capture

Jump to solution

It's my understanding that these settings are configured from 'Disk Space Management' (GW Properties -> Logs -> Local Storage). Here you can also define how much disk space will be allocated for packet capturing. Files should be stored until we start running out of space (then log rotation starts working as per the settings)

0 Kudos