Create a Post
Showing results for 
Search instead for 
Did you mean: 
Champion Champion

Memory usage of FW Monitor

Check Point just published an interesting article about the memory usage of FW Monitor (sk160954).

It's interesting to see that it makes great sense to use the '-v' flag on VSX systems in order to allocate memory just for a specific Virtual System and avoid memory utilization cumulation.

Therefore I'll extend my FW Monitor SuperTool to detect VSX systems and force the usage of the -v flag.

1 Reply
Legend Legend

This is a great SK; the amount of memory that fw monitor -e consumes when it is executed is much, much larger than using tcpdump or cppcap, especially on bigger firewalls where the command's memory usage scales up with the number of cores.  As an example on a non-VSX 24-core firewall with a 4/20 CoreXL split, running fw monitor -e will immediately consume an additional 544MB of RAM. If the firewall is utilizing the traditional kernel-based operation instead of the newer User Space Firewall (USFW), the majority of this memory consumption incurred by fw monitor -e will be in kernel space, where it is far more likely to negatively impact the performance of the firewall.

Gateway Performance Optimization R81.20 Course
now available at
0 Kudos


Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events