Firewall connections script

[the_rock]

Hey team,

This script generates txt file with all the connections through the firewall. dos2unix and chmod 777 needed before running it.

Example in my lab fw:

[Expert@CP-GW:0]# ./connections.sh
Saved: /var/log/conndump/connections-CP-GW-conntab-20260122-082307.txt.gz
[Expert@CP-GW:0]# cd /var/log/conndump
[Expert@CP-GW:0]# more connections-CP-GW-conntab-20260122-082307.txt.gz

==== Check Point Connections Dump ====
Timestamp : 2026-01-22T08:23:07-0500
Host : CP-GW
Mode : conntab

Command: fw ctl conntab
--------------------------------------
<(inbound, src=[0.0.0.0,68], dest=[255.255.255.255,67], UDP); 37/40, rule=10, service=bootp(329), Ifncin=1, conn modules: , Authentication, FG-1, >

<(outbound, src=[172.16.10.249,35041], dest=[8.8.4.4,53], UDP); 38/40, rule=33554432, service=domain-udp(353), Ifnsin=1, Ifnsout=1, conn modules: , Authentication, FG-1, SynDoSDefender, >

<(outbound, src=[172.16.10.249,49157], dest=[172.16.10.252,257], TCP); 2171/3600, rule=369098752, tcp state=TCP_ESTABLISHED, service=FW1_log(80), Ifnsin=1, Ifnsout=1, conn modules: Authentication, FG-1, >

<(inbound, src=[100.65.16.3,59110], dest=[172.16.10.249,22], TCP); 3598/3600, rule=8, tcp state=TCP_ESTABLISHED, service=ssh(507), Ifncin=1, Ifncout=1, conn modules: , Authentication, FG-1, ISP-Redundancy, >

<(outbound, src=[172.16.10.249,47732], dest=[8.8.8.8,53], UDP); 38/40, rule=33554432, service=domain-udp(353), Ifnsin=1, Ifnsout=1, conn modules: , Authentication, FG-1, SynDoSDefender, >

<(inbound, src=[100.65.16.3,64238], dest=[172.16.10.249,22], TCP); 3578/3600, rule=8, tcp state=TCP_ESTABLISHED, service=ssh(507), Ifncin=1, Ifncout=1, conn modules: , Authentication, FG-1, ISP-Redundancy, >

<(outbound, src=[172.16.10.249,57515], dest=[172.16.10.252,257], TCP); 3547/3600, rule=369098752, tcp state=TCP_ESTABLISHED, service=FW1_log(80), Ifnsin=1, Ifnsout=1, conn modules: , Authentication, FG-1, >

<(inbound, src=[172.16.10.252,40635], dest=[172.16.10.249,18192], TCP); 3595/3600, rule=301989888, tcp state=TCP_ESTABLISHED, service=CPD_amon(17), Ifncin=1, Ifncout=1, conn modules: , Authentication, FG-1, >

<(outbound, src=[172.16.10.249,34031], dest=[172.16.10.252,257], TCP); 3580/3600, rule=369098752, tcp state=TCP_ESTABLISHED, service=FW1_log(80), Ifnsin=1, Ifnsout=1, conn modules: , Authentication, FG-1, >

<(inbound, src=[172.16.10.252,51045], dest=[172.16.10.249,18192], TCP); 3544/3600, rule=301989888, tcp state=TCP_ESTABLISHED, service=CPD_amon(17), Ifncin=1, Ifncout=1, conn modules: , Authentication, FG-1, ISP-Redundancy, >

<(outbound, src=[172.16.10.249,56643], dest=[1.1.1.1,53], UDP); 38/40, rule=33554432, service=domain-udp(353), Ifnsin=1, Ifnsout=1, conn modules: , Authentication, FG-1, SynDoSDefender, >