IPS packet capture

[Alexander_K]

In R77.30 and earlier IPS packet capture was stored on the gateways as .pcap files and we could retrieve them using "fwm getpcap" over SSH. In R80+, IPS has been moved to Threat Prevention and it seems that packet capture is now being stored as .EML files. Looking at the logs from "fw log", the "packet_capture_unique_id" is now a name, where on earlier versions this was a ID number. Tried running "fwm getpcap" with different ID's from the logs, but all returning errors.

I heard that there are plans to stop using .EML files, but until then, are there any ways to get the IPS packet captures out from SSH?

[PhoneBoy]

Hm... good question.

Let me ping my friends in R&D about this one.

[PhoneBoy]

Turns out that’s in R80.10+, the packet captures are stored on the log server, not the gateway as was the case in R77.30 and earlier.

Consequentially, the fwm getpcap command does not work for R80.10+ Gateways

An API for this is planned in R80.20.

Also, in R80.20, we plan to make the pcap available as a pcap (not EML).

Meanwhile, in R80.10, the only way to get the capture is via SmartConsole.

[Alexander_K]

Thanks, will await for R80.20 then

[Jim_Stergiou]

Did the ability to pull pcaps from the API make it into the R80.20 EA?

[PhoneBoy]

I don't see anything in the API docs for it offhand...

[Pablo_Munoz · Accepted solution]

I don't know if this is too late, but maybe sk120773 helps:

IPS packet captures are located on on the Security Gateway in:

• Before R80.x - $FWDIR/log/captures_repository 
• In R80.10 - $FWDIR/log/forensics and /var/log/spool/mail/

[PhoneBoy]

Never too late for a correct answer

The nice thing is in R80.10, these files are stored as .cap files directly, which means Wireshark and other tools can read them.

[Brian_Olesen]

In a R80.10 installation it seems that there is only .cap files for the last couple of days. Does anyone know for how long the .cap files are stored and where it can be configured?

[Pablo_Munoz]

It's my understanding that these settings are configured from 'Disk Space Management' (GW Properties -> Logs -> Local Storage). Here you can also define how much disk space will be allocated for packet capturing. Files should be stored until we start running out of space (then log rotation starts working as per the settings)

[Oliver_Fink]

It seems that R81.10 does not offer the possibility to configure this anymore:

Same on R80.30:

[Timothy_Hall]

This is configured on the gateway object, not the SMS.  The Local Storage screens you are showing are for an SMS.