Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Achilles_Tagg
Participant
Jump to solution

How to determine top talker host IP

Want to determine top talker host in checkpoint via cli. Any idea how?

OS: IPSO Kernel Ver. 4.2

2 Solutions

Accepted Solutions
HeikoAnkenbrand
Champion Champion
Champion

Source IP Top 10

fwaccel conns | awk '{print $1}' | sort | uniq -c | sort -n -r | head -n 10

 Destination IP Top 10

fwaccel conns | awk '{print $3}' | sort | uniq -c | sort -n -r | head -n 10

 

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips

View solution in original post

HeikoAnkenbrand
Champion Champion
Champion

You can also use "fw tab -t connections -u -f" and change the parameter for the "print $x" command.

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips

View solution in original post

7 Replies
Timothy_Hall
Legend Legend
Legend

Assuming SecureXL (flows) is enabled, you should be able to use the Top Talkers script by @Craig_Dods, not sure if it will work on IPSO but worth a try:

http😕/expert-mode.blogspot.com/2013/05/checkpoint-top-talkers-script-display.html

 

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com
PhoneBoy
Admin
Admin

IPSO 4.2 implies you're running R65 or earlier, which hasn't been supported for quite a while. Pretty sure there is no facility for this in those releases. You might be able to write a script to parse the connections table to see who the top talker is "right now."

SmartView Monitor may be an option assuming you have a license for it and it runs on IPSO (don't remember if it's supported or not). Otherwise, you'd have to parse the logs to figure this out.

HeikoAnkenbrand
Champion Champion
Champion

Source IP Top 10

fwaccel conns | awk '{print $1}' | sort | uniq -c | sort -n -r | head -n 10

 Destination IP Top 10

fwaccel conns | awk '{print $3}' | sort | uniq -c | sort -n -r | head -n 10

 

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
HeikoAnkenbrand
Champion Champion
Champion

You can also use "fw tab -t connections -u -f" and change the parameter for the "print $x" command.

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
Simon_Macpherso
Advisor

HI @HeikoAnkenbrand in the context of using fw tab -t connections -u -f, can you please explain what you mean by changing the parameter for the print $x command?

0 Kudos
Achilles_Tagg
Participant

Appreciate it! Thanks

Bryce_Myers
Collaborator

You can use Smartview Monitor from the CLI with rtm monitor.

For example:

# rtm monitor -k src -v wb sort=top -i 60

Will give you an output every 60 seconds of top source addresses.

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events