Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 

Easy Tool - R81.20 Real time connection table analysis v5.0

HeikoAnkenbrand
Champion Champion
Champion
Overview


Now for R81.20.

For many Check Point users the question arises again and again, which connections and services are used by a rule, a port, an destination IP or source IP  in real time. For this purpose I have created a small tool, which all information about a rule can be read out in real time from the connection table.

This is good for optimizing the ruleset, as it provides a real-time view of the connection table with the corresponding info

...;
TO ACCESS CHECKMATES TOOLBOX it's simple and free

Disclaimer: Check Point does not provide maintenance services or technical or customer support for third party content provided on this Site, including in CheckMates Toolbox. See also our Third Party Software Disclaimer.




(5)
20 Replies

Danny
Champion Champion
Champion

Previous versions are there:

;
TO ACCESS CHECKMATES TOOLBOX it's simple and free


_Val_
Admin
Admin

Heiko, what is the reason to post the same tool, version by version, as a new post? Why not to update the existing ones?

;
TO ACCESS CHECKMATES TOOLBOX it's simple and free


0 Kudos
(1)

HeikoAnkenbrand
Champion Champion
Champion

It is a new version that supports R81.20, as some things have changed in the "fw ctl conntab" tool in R81.20.
For example, since about R80.40 the parameter -x was specified, but this did not work in the older versions. As of R81.20, this parameter works.

Furthermore, the formatting in R81.20 is different and it is not so easy to adapt in this complex code.

Therefore, I had to adapt the script a bit and it now works with R81.20.

From my point of view it is easier to download the script in

...;
TO ACCESS CHECKMATES TOOLBOX it's simple and free


_Val_
Admin
Admin

Gotcha, thanks for clarifying this. I suspected that was the case but wanted to make sure.

;
TO ACCESS CHECKMATES TOOLBOX it's simple and free


0 Kudos

G_W_Albrecht
Legend
Legend

[Expert@GW8120:0]# curl_cli -k http://www.ankenbrand24.de/inst_econn5 > /tmp/inst_econn5 && chmod 770 /tmp/inst_econn5 && /tmp/inst_econn5
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 22 100 22 0 0 153 0 --:--:-- --:--:-- --:--:-- 282
/tmp/inst_econn5: line 1: Imperva_WAF_Protected: command not found

[Expert@GW8120:0]# econn -a

 


Real time connection table analysis by Heiko Ankenbrand 2021 (v4.0)

Connection Summary
Search

...;
TO ACCESS CHECKMATES TOOLBOX it's simple and free


0 Kudos

HeikoAnkenbrand
Champion Champion
Champion

Hi @G_W_Albrecht,


Now it works.

;
TO ACCESS CHECKMATES TOOLBOX it's simple and free


G_W_Albrecht
Legend
Legend

New install:

Interface
Incomming : sh: -c: line 0: syntax error near unexpected token `('
sh: -c: line 0: `cat /tmp/econn_if |grep ^Entrust-Admin(19)'
eth0
Outgoing : eth0

Services
CP Service :

;
TO ACCESS CHECKMATES TOOLBOX it's simple and free


0 Kudos

HeikoAnkenbrand
Champion Champion
Champion

Please give me a little more time.
I need to look at the script and fix the issue.

;
TO ACCESS CHECKMATES TOOLBOX it's simple and free


0 Kudos

G_W_Albrecht
Legend
Legend

Kein Stress - lieben Gruß aus Wien !

;
TO ACCESS CHECKMATES TOOLBOX it's simple and free


0 Kudos

G_W_Albrecht
Legend
Legend

Seems 5.0 version is no longer available...

;
TO ACCESS CHECKMATES TOOLBOX it's simple and free


0 Kudos

_Val_
Admin
Admin

Yep, the attachment is definitely missing.  @HeikoAnkenbrand was it intentional?

;
TO ACCESS CHECKMATES TOOLBOX it's simple and free


HeikoAnkenbrand
Champion Champion
Champion

Thank you guys

Had disabled http on my web server and now only use https.
The old links still pointed to http://....
I just changed it to https://...

Now everything should work again.

;
TO ACCESS CHECKMATES TOOLBOX it's simple and free


G_W_Albrecht
Legend
Legend

- Version 4.0

- Error:

Interface
Incomming : sh: -c: line 0: syntax error near unexpected token `('
sh: -c: line 0: `cat /tmp/econn_if |grep ^Entrust-Admin(19)'

;
TO ACCESS CHECKMATES TOOLBOX it's simple and free


0 Kudos

Jemma
Explorer

The tool works perfectly under R81.20.

;
TO ACCESS CHECKMATES TOOLBOX it's simple and free


the_rock
Legend
Legend

Awesome!!  @HeikoAnkenbrand , quick question...I cant seem to get -w filter working, shows not available, unless theres different syntax for it?

;
TO ACCESS CHECKMATES TOOLBOX it's simple and free


0 Kudos

HeikoAnkenbrand
Champion Champion
Champion

The option -w <filename> should write the connection table to a tar file to be used later with the option -f <filename.tar>

;
TO ACCESS CHECKMATES TOOLBOX it's simple and free


0 Kudos

the_rock
Legend
Legend

Would you mind give me a simple example? I cant get it going on my R81.20 lab fw.

;
TO ACCESS CHECKMATES TOOLBOX it's simple and free


0 Kudos

HeikoAnkenbrand
Champion Champion
Champion

econn -w my_file -r 3                    -> Write all connection table entries in a file with the filter on rule 3

econn -f my_file -c -e SYN           -> Open the file and search for all connections with TCP SYN state

;
TO ACCESS CHECKMATES TOOLBOX it's simple and free


(1)

the_rock
Legend
Legend

Thanks mate...silly me, was mispelling the command, apologies.

Cheers,

Andy

;
TO ACCESS CHECKMATES TOOLBOX it's simple and free


0 Kudos

G_W_Albrecht
Legend
Legend

Still only version 4.0 available...

;
TO ACCESS CHECKMATES TOOLBOX it's simple and free


0 Kudos