Who rated this post

cancel
Showing results for 
Search instead for 
Did you mean: 
Bob_Zimmerman
MVP Gold
MVP Gold

-e takes an INSPECT code fragment and effectively causes the firewall kernel to capture traffic which matches that fragment. This only works when the traffic actually makes it to the firewall kernel, though. SecureXL exists specifically to skip over this code, so when SecureXL is enabled, most of the capture points won't record anything.

-F is the current way to write filters. It's not very flexible. There's no way to specify a source or destination network, or a range of ports. That said, it works with SecureXL enabled. As long as the traffic you want to capture can fit into the five -F filter slots, it's the method to use.

View solution in original post

(1)
Who rated this post