WireShark profile for `fw monitor`

[Hugo_vd_Kooij]

I write a Wireshark profile to help you with reading `fw monitor` files.

I wrote a Dutch description on Wireshark Profiles and I guess the screenshots will be sufficient help to get you started for those not savvy in Dutch 😉

The Short English Version:

1. Create a Dummy personal profile (Name it whatever you like)
2. In WireShark, Goto Help => Folders and then proceed to your Personal Configuration directory
3. Put the ZIP file in the Profiles directory and unpack it.
4. Now you have your own Check Point profile that has coloring rules and some other smart things.

Feel free to mention any smart tricks with Wireshark you use the speed up reading `fw monitor` files.

[Danny]

Wireshark Profiles - English version via Google Translate

Related SKs:

How to configure Wireshark for analysis of FW Monitor captures

Maximum recommended capture file size for Wireshark

How to work with large traffic capture files

What is FW Monitor?

How to use FW Monitor

What happened to Check Point Ethereal (CPEthereal)?

[Hugo_vd_Kooij]

 WireShark profiles (Translated by Google) 

If some lines don't make sense in English. .... That's what you get from bot translators.

You can always try to learn Dutch 😉

[Maarten_Sjouw]

Wow, I see my post from 2008 on CPUG found it's way back again....

[PhoneBoy]

Been a while since I've seen this.

[Ofir_Shikolski]

cool

I even more like this one : Hugo's website: PowerShell, AD computers to Check Point objects  -> psCheckPoint Documentation  

[Hugo_vd_Kooij]

I found that in the PCAP file we loose something. If you run fw monitor on the screens you can see how things are picked up internally.

The first (i) will be part of the performance pack. And then you get a second (i) on the actual core that picks up the packet. On TCP this is only on the SYN packet. But on UDP this happens a lot more. 

It would be cool if fw monitor could be enhanced to put this information into comments if you use pcapng as output format.

Who should we buy strooopwafels to get this into a future version?