fw monitor

[Vladimir_S]

Hello,

I need to monitor inbound traffic between an external source and Check Point security gateway external interface on port 443.

R82 Take 12 runs on the security gateway.

Here is the syntaxis of fw monitor that I use on the gateway:

fw monitor -F "0.0.0.0, 0, 12.69.98.28, 443, 6" -pi

And here is output:

PPAK 0: Get before set operation succeeded of fwmonitor_kiss_enable
PPAK 0: Get before set operation succeeded of fwmonitor_debug_filter_off
PPAK 0: Get before set operation succeeded of fwmonitorfreebufs
Invalid destination IP address 12.X.X.28 in debug filter

I replaced part of the public IP address of my gateway with X.

Any suggestions to get correct output?

Thank you.

[Lesley]

Try:

fw monitor -m i -F "0,0,1.1.1.1,443,0"
replace 1.1.1.1 with your ip and please edit your post in the output you still can see the full public ip

[Vladimir_S]

Hi Lesley,

The command worked!! Another question, for the fw monitor filter, what expression should be added to capture ICMP traffic?

Thank you,

Vlad.

[Lesley · Accepted solution]

fw monitor -m i -F "0,0,1.1.1.1,0,1"

[Vladimir_S]

Thank you Lesley, it works too!!

Vlad.