How to Identify DDoS attack on Check Point Gear

[Shay_Levin]

@matanbd This is an awesome document!  Everyone should read it.

For those of you who don't know Matan, he is one of the most talented Check Point incident response team member.

So, if you are in trouble, Matan is definitely your guy.

[Matthias_Kring]

With 80.30, the "timestamp" in cpview -t seems to be unavailable (sk101878). Instead, it starts at the beginning of history, and you have to move forward in "minute steps".

That's not nice.

[matanbd]

@Matthias_Kring Hi Matthias,

thanks for letting me know about this.

it looks like the design has been changed since R80.30 in CPView history mode and sk163804 describe the change:

1. Run the 'cpview -t' command.
2. In CPView history, type t.
3. Specify the desired date and time. 

i will add this info to the post itself.

BR
Matan

[pahanadmin]

Great,what about SMB devices..

[jfran3]

Is there any guidance for detecting this using only the SmartConnect interface? So if we have analysts who don't have access to run cpview for instance?