- Products
- Learn
- Local User Groups
- Partners
-
More
Celebrate the New Year
With CheckMates!
Value of Security
Vendor Self-Awareness
Join Us for CPX 360
23-24 February 2021
Important certificate update to CloudGuard Controller, CME,
and Azure HA Security Gateways
How to Remediate Endpoint & VPN
Issues (in versions E81.10 or earlier)
Mobile Security
Buyer's Guide Out Now
Important! R80 and R80.10
End Of Support around the corner (May 2021)
Hi All,
In of our Checkpoint box inetrface utilization is going 98%(recieved) so just want to know which which users are sending the most
traffic and try to catch them . Gateway is R77.30 and want to know the output just like "ip-accounting" in Cisco ...
Please require your support .
Hi All
One thing also want to add that eth1-06 is the physical interface of the VSX gateway which is showing 96% of recieved utilization
and no ip is configured on this . There are 7-8 VSs like checked vsenv 7--> eth1-06.2781 like this different VLANs interfaces belong
to different VSs.
Very basic, but have you tried tcpdump, often enough you can see high bandwidth users from tcpdump. Just explicitly set good flags to stop the capture and not to saturate CPU. I.e count, -c xxx
See the VSX-specific sections of these SK's, the short answer is you have to use CPMonitor:
sk164215: How to Detect and Handle Heavy Connections
sk122013: Handling heavy connections in CoreXL
sk167553: Performance Investigation Procedure - How To
well you do have the routing table/antispoofing so just filter on those prefixes(networks) first then smartlog will do new calculation on top source and destinations.
Regards,
Magnus
How about using SmartviewMonitor and looking for top source, destination or service on the interface ?
Wolfgang
About CheckMates
Learn Check Point
Advanced Learning
WELCOME TO THE FUTURE OF CYBER SECURITY