Cannot use Whois lookup in SmartConsole on Server 2019

[Joe_Kanaszka]

Hey guys. This is a weird one and I’ve been at this for the better part of the afternoon. 

I’m running the latest version of SmartConsole r81.20 on two machines:  Windows 11 23H2 laptop and Server 2019. 

I have a rule that allows both machines out to port 43 (nickname svc)

While on my Windows 11 laptop, I can right click on an IP while in log view and run the built-in Check Point lvwhois.exe utility. It works fine. I can also telnet to Whois.arin.net 43.  

While on my Server 2019 box, I can run a Telnet to Whois.arin.net just fine. 
However, I cannot use the built in lvwhois utility. The Whois window will launch but no info comes up.  

There is nothing in the logs when this happens. 

This has to be some sort of of a bug no?
Any ideas?  It’s driving me nuts!  🙂

[the_rock]

Hey brother,

Not sure if this could be a bug, but let me try in the lab tomorrow.

Andy

[the_rock]

In the meantime, FWIW, here is what our "friend" chatgpt says : - )

****************************

• Where it runs from
  lvwhois.exe is a helper binary inside the SmartConsole install folder. When you right-click an IP in the logs, SmartConsole spawns it and passes the IP as an argument. It doesn’t reuse your shell session (where you tested telnet), so anything about its environment matters (permissions, DLLs, registry, etc.).

• Why Telnet works but lvwhois doesn’t
  Since Telnet works, connectivity and firewall rules are good. The issue is local to how SmartConsole/lvwhois executes on Server 2019.

• Known quirks

  • lvwhois.exe relies on WinInet/WinHTTP APIs. If your Server 2019 has IE hardened security (ESC) or missing proxy settings, the call can silently fail.

  • Some people have reported the WHOIS tool failing under Server OSes due to .NET framework mismatches or missing runtime libraries that are present on client Windows editions.

  • CheckPoint doesn’t officially test SmartConsole on Windows Server as much as client OSes — they mainly support Windows 10/11 for daily admin consoles.

• Things to test

  • Run lvwhois.exe <IP> manually from C:\Program Files (x86)\CheckPoint\SmartConsole\R81.20\PROGRAM\ — does it still hang?

  • Compare the whois_servers.conf file in the same directory on both machines. Sometimes the file doesn’t populate properly.

  • Run SmartConsole as Administrator on the server box (UAC can block child processes).

  • Check if your Server 2019 has TLS/SSL hardening policies — the whois utility is old-school, but if it can’t resolve DNS through the WinHTTP stack it just returns nothing.

  • As a quick sanity check, copy the lvwhois.exe + whois_servers.conf from the working laptop into the same path on the server, overwrite, and try again.

• If all else fails
  This is likely a bug/unsupported behavior on Server 2019. The workaround would be to run SmartConsole on a client OS (Win10/11) for whois lookups, or just use an external whois tool on the server.

[the_rock]

Btw, since this was also bugging me, I did replicate it as well, I believe it is a bug.

Maybe someone from CP can confirm.

Andy

[Joe_Kanaszka]

Yea - I can't run it from the command line either as stated above in your troubleshooting.  

[the_rock]

Thats right.

[the_rock]

Now I wonder if the issue is strictly with windows server 2019 or simply not compatible...who knows. Let me see if I can do some debugging on it.

Andy

[Joe_Kanaszka]

I need to carve out some time and build a Check Point lab on top of EVE-NG.  What is the learning curve like for someone with no EVE-NG experience?  Did you build your lab on a baremetal Linux box or 
Windows?  Thanks Andy!

[the_rock]

My colleague built it for us, its on some powerful open server with 512 GB of ram, man, gotta tell you, its so fast, we have 10 different images on it (cisco, fortinet, cp, aruba, silverpeak, sophos...) I kid you not, LONGEST it took to spin up whole thing for any given vendor was 5 mins.

Andy

[Joe_Kanaszka]

That's the way to go.  I can find an old server and re-purpose it I'm sure.  Now I just need to find the time!  

I never asked you, do you work for an MSP?

[the_rock]

I do, yes. Message me offline brother, we can connect that way, if you prefer.

Best,

Andy

[the_rock]

Here is screenshot for reference.

Andy

[Joe_Kanaszka]

**bleep**!  Nice!

[the_rock]

Its great, we all love it!

[the_rock · Accepted solution]

Hey mate,

I even had colleague check this with me and he is one of the smartest guys I know and we still could not figure it out. I wont give up, but I have a gut feeling it might not be supported or it is indeed a bug, or both lol

Andy

[the_rock · Accepted solution]

Hey brother,

To help you even further, I tested windows server 2016, 2019, 2022 and 2025, EXACT same issue, whois window shows up, says wait for 2 seconds, then nothing.

Things I tried:

-installed latest windows updates

-tried web smart console

-tried portable smart console

-also tested running console from R82 folder in C;programfiles x86/CheckPoint//smartconsole/R82

-tried compatibility mode

Nothing...so honestly, my only LOGICAL assumption is that this simply does not work on any windows server "flavor" : - )

Andy

[Joe_Kanaszka]

Morning Andy and thank you for the thourough testing!  Much appreciated!

[the_rock]

Anytime! Thats where eve-ng comes in handy ; - )