This website uses Cookies. Click Accept to agree to our website's cookie use as described in our Privacy Policy. Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
ABOUT CHECKMATES CYBER SECURITY COMMUNITY & FAQ
Create a Post
Help
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 

CPPCAP - Alternative to tcpdump on Gaia

Are you a member of CheckMates?

×
Sign in with your Check Point UserCenter/PartnerMap account to access more great content and get a chance to win some Apple AirPods! If you don't have an account, create one now for free!
_Val_
Admin
Admin
7 3 4,967
‎2018-12-26 11:51 PM

Are you still running standard Linux tcpdump on your Firewalls? Did you know it can cause high CPU utilization?

For better results, use CPPCAP - Check Point specialized traffic capture utility. For more information, read this SecureKnowledge Article: sk141412

Tags (2)
3 Comments
s_milidrag
Contributor
Contributor
‎2018-12-27 12:14 AM

What tool is more preferred to use fw monitor or cppcap ?

0 Kudos
_Val_
Admin
Admin
‎2018-12-27 06:27 AM

It depends on a specific scenario. FW monitor shows you how traffic is passing FW kernel chains. CPPCAP & tcpdump are about how traffic looks on network interfaces. These two cases are linked but not identical

0 Kudos
HeikoAnkenbrand
Champion Champion
Champion
‎2018-12-27 01:48 PM

Hislobodan milidrag ,

You can found more informations in this article:

https://community.checkpoint.com/docs/DOC-3406-r80x-performance-tuning-and-debug-tips-tcpdump-vs-cpp... 

Regards

Heiko