- CheckMates
- :
- Products
- :
- Quantum
- :
- Security Gateways
- :
- Re: tcpdump, fw monitor and fw ctl zdebug commands...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
tcpdump, fw monitor and fw ctl zdebug commands and performance impact
Good day
We have highly loaded security gateways that currently need traffic analysis.
In this article https://community.checkpoint.com/t5/Security-Gateways/quot-fw-ctl-zdebug-quot-Helpful-Command-Combin... I came across information that the utility negatively affects on performance .
Please tell me how critically it can affect on performance, which of the systems (CPU, RAM, traffic) is loaded the most?
Is it possible to reduce resource consumption through parameters like specifying the interface that will be dump?
How much traffic can fw monitor and tcpdump also load?
- Labels:
-
Routing
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Use cppcap instead of tcpdump.
Kernel debug will have an impact on your FW, especially if it's already loaded as you say. They have to be started and stopped properly.
It's best to consult first with TAC to review your situation.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
TAC give you an answer for multiple days, we can t wait so long. Problem is in thing, that documentation don t describe important things like how much impact of performance, in what situation we can it on, in what we cant and another things...
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you please explain why you need tcpdump and fw monitor for traffic analysis ? Usually cpview gives you the needed look into secureXL state, see the following:
sk167553: Performance Investigation Procedure - How To
sk98348: Best Practices - Security Gateway Performance
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
unstable traffic in video conferences without any negative symptoms (packet drops in the smartlog, CPU overload, and etc) is a main problem
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
And the most interesting question is whether the load will change depending on the parameters that you set
