Connections Table Confusion and sk65133

[Justin_Hickey]

I'm dealing with timeout issues and I need to prove to another organization that Checkpoint is not the cause of the timeout. I want to find the connection in the connection table with the timer showing the live ttl and timeout.

sk65133 seems to be the correct article explaining how to do this but I'm lost on how to craft the correct syntax. The table is all in hex. Please consider this my enhancement request to please convert it to standard decimal. Either that or add real world examples on how to search for a connection in the sk65133.

Let's say I want to find a connection for ip 192.168.255.250 . I cant seem to locate the connection with the below fw tab command and grep. I'm likely doing something wrong. Any insight is appreciated.

ft tab -t 8158 | grep C0A8FFFA

Thanks,

Justin

[Marco_Valenti]

before start to searching trought the connection table in my opinion I will try to have a look at the log and see if you have some packet flagged as out of state between the two host  , consider that if you don't have changed stateful setting in the global proprerties the default timeout for a tcp session is 3600 seconds , could be the case that the application in use does not send any keep alive to the client and the gateway then remove from his connection table.

In any case you can retrieve information about the session with a simple tcpdump capture.

Otherwise you can look in the thread my top cli command here , there are a lot of examples for retrieving such info

[Timothy_Hall · Accepted solution]

Try this:

fw tab -u -t connections | grep -i C0A8FFFA

The current timeout values for that connection will be on the far right of the display for each connection and look like: (3500/3600).  The first number is a countdown timer and shows how much time is remaining until expiration, unless traffic matching that connection is processed in which case the countdown starts anew.  The second number is the expiration time for that type of connection, inherited from the "Stateful Inspection" screen of the Global Properties or overridden by the Advanced tab of the service object in question.  Note that trying to use -f to see decimal IP addresses with the above command will exclude the timeout values from the output.

This situation is mentioned in my book (p. 87-91), check out the TCP state logging function which can be very helpful diagnosing issues such as these (especially a kernel value of 2):

sk101221: TCP state logging

--
My book "Max Power: Check Point Firewall Performance Optimization"
now available via http://maxpowerfirewalls.com.

[Justin_Hickey]

Thanks for the replies

fw tab -u -t connections | grep -i XXXXXXXX | grep -i XXXXXXXX
(the X's being the hex equiv. of the ip's) find a ip to hex converter on the web if you're bad at math like me and discard the leading '0x'.

works for me, finds connections between two specific endpoints and shows the ttl/timeout value.  3155/3600

Thanks again.

[Astardzhiev]

fw tab -t connections -u -f
-f will format the output to decimal values.You can add "grep" to filter based on your IP address in decimal

Example: fw tab -t connections -u -f | grep 10.10.10.10

However formatting from hex to dec is taking some time, so if you try to catch sort connections it is possible that you will not capture it, so it will be good idea to use Tim's suggestion - hex and grep with -i (without -i grep is case sensitive)

[kb1]

hello what if we want to add source as well as destination ip?? i tried using something like this for source and destination-

fw tab -u -t connections -f | grep 10.8.196.217 | grep 40.97.136.200

but it doesnt work!!

[sserrentinoBPS]

try this:

fwaccel conns | awk -v src=x.x.x.x -v dst=y.y.y.y '$1==src && $3==dst{print}' | sort | sort -n -r

source ip:= x.x.x.x

destination ip:=y.y.y.y