Memory usage of FW Monitor

[Danny]

Check Point just published an interesting article about the memory usage of FW Monitor (sk160954).

It's interesting to see that it makes great sense to use the '-v' flag on VSX systems in order to allocate memory just for a specific Virtual System and avoid memory utilization cumulation.

Therefore I'll extend my FW Monitor SuperTool to detect VSX systems and force the usage of the -v flag.

[Timothy_Hall]

This is a great SK; the amount of memory that fw monitor -e consumes when it is executed is much, much larger than using tcpdump or cppcap, especially on bigger firewalls where the command's memory usage scales up with the number of cores.  As an example on a non-VSX 24-core firewall with a 4/20 CoreXL split, running fw monitor -e will immediately consume an additional 544MB of RAM. If the firewall is utilizing the traditional kernel-based operation instead of the newer User Space Firewall (USFW), the majority of this memory consumption incurred by fw monitor -e will be in kernel space, where it is far more likely to negatively impact the performance of the firewall.