IPS Analyzer Tool - are you running it?

[Tomer_Sole]

The IPS Analyzer Tool runs on your gateway for a short amount of time, and issues an HTML report of which individual IPS protections took the most CPU and RAM on the gateway during the runtime of the tool.

Supported Gateways are R77 and above.

For more information go to IPS Analyzer Tool - How to analyze IPS performance efficiently 

I wanted to use this thread to ask who is running it and what are your thoughts of it. 

Q: Why can't I run it from SmartConsole by default?

A: We plan to add that in one of our next releases.

(Don't mind the actual names of the protections in this screenshot, this image is not a result of a run on an actual gateway, it is a random generation of existing protection names, just to showcase the report's look and feel):

Smadi Paradise‌ Omer Shliva‌

[Smadi_Paradise]

Thanks

[Gomboragchaa]

Thank you,

 It is a little bit complicated to get by an e-mail.

==============================================

For getting the latest version of Analyzer tool please contact:

IPS_Analyzer_Tool@checkpoint.com

==============================================

[Arne_Boettger]

I tried to use it, but never got useful output.

First, I did not enjoy using it because with MDS and VSX, there are many steps to perform manually to get visible output.

And second, most of the time my IPS Analyzer output was empty. I am not sure if this was due to "IPS Bypass under load" or simply no relevant connections during my run.

So, third, I was missing a concise instruction like how long to run the capture to get useful output, wether it captures only new connections during the run or also existing connections.

[Mircea_Mitroi]

Hey!

I tried to use it today for a customer and received twice some confusing, incomplete results...there were no protection names. Any idea?

Thx,

Mircea

[Stephan_Minkole]

Same here.

Any hints to resolve are appreciated.

[Omer_Shliva]

The tool can now be downloaded from here:

https://community.checkpoint.com/docs/DOC-3176-ips-analyzer-tool-how-to-analyze-ips-performance-effi... 

[r1der]

Hello, is this tool available for R80.40 or is there something better? I tried to access the link but get an "Access Denied", even when logged in.

You do not have sufficient privileges for this resource or its parent to perform this action.

[Arne_Boettger]

Hello,

I, also, wanted to use the IPS Analyzer to verify something in the lab. The SK shows "Access Denied" even tough I can find it an it is listed as "Access Level: Basic".

As @Tomer_Sole seems to be inactive, maybe @Omer_Shliva can give us an explanation?

Kind regards, Arne

[_Val_]

Hi Arne, the tool is retired, and SK is not longer available. Mind, this post is 4 years old. 

[Marcel_Gramalla]

I found this tool quite helpful. Is there any new tool for analyzing performance of IPS and maybe even other Blades? Would be really cool to see something like FW is only taking 20% CPU Usage, but IPS adds another 10% and AV/AB 20% etc.. 

[Arne_Boettger]

Hi Val,

thank you for the quick response. I found it implemented as "ips stats" and "ips pmstats" and will give it a try with R81.10.

Nonetheless it would be helpful to place this information in an SK article, because a search for "IPS Analyzer" lists sk110737, the popup help lists R81.10 as relevant, but the SK does not load with an error message.

Kind regards, Arne

[_Val_]

What kind of search are you referring to, Google?

[Marcel_Gramalla]

Support Page actually displays this:

[_Val_]

Hmmm, might be a caching issue, thanks for reporting. I will pass it on to the Support Center ppl