CPPCAP - Alternative to tcpdump on Gaia

[_Val_]

Are you still running standard Linux tcpdump on your Firewalls? Did you know it can cause high CPU utilization?

For better results, use CPPCAP - Check Point specialized traffic capture utility. For more information, read this SecureKnowledge Article: sk141412

[s_milidrag]

What tool is more preferred to use fw monitor or cppcap ?

[_Val_]

It depends on a specific scenario. FW monitor shows you how traffic is passing FW kernel chains. CPPCAP & tcpdump are about how traffic looks on network interfaces. These two cases are linked but not identical

[HeikoAnkenbrand]

Hislobodan milidrag ,

You can found more informations in this article:

https://community.checkpoint.com/docs/DOC-3406-r80x-performance-tuning-and-debug-tips-tcpdump-vs-cpp... 

Regards

Heiko