Header/footer test page

My Favorites

Solution ID: sk30583

Technical Level:

Basic

Email

Print

What is FW Monitor?

ProductCluster - 3rd-party, ClusterXL, CoreXL, IPS, IPSec VPN, SecureXL, Security Gateways, VSX (Traditional)

VersionR80.10 (EOS), R80.20 (EOS), R80.30 (EOS), R80.40 (EOS), R81 (EOS), R81.10 (EOS), R81.20

Last Modified2026-02-15

Solution

Table of Contents:

1. Introduction

2. Warnings

3. FW Monitor Features

4. FW Monitor Functionality

5. FW Monitor Syntax and Usage

6. Syntax

7. Comparison with TCPdump

8. Using the UUID feature

9. SecureClient Syntax

10. Capture Examples of "-e" flag

11. Usual Capture

12. Host Specific Capture

13. Port Specific Capture

14. Protocol Specific Capture

15. Protocol Options Specific Capture

16. Bytes Specific Capture

17. Network Specific Capture

18. Some Examples

19. Capture Examples of "-F" flag

20. Usual Capture

21. Host Specific Capture

22. Port Specific Capture

23. Protocol Specific Capture

24. Related Documentation

25. Related Solutions

(1) Introduction

Check Point's FW Monitor is a powerful built-in tool for capturing network traffic at the packet level. The FW Monitor utility captures network packets at multiple capture points along the FireWall inspection chains. These captured packets can be inspected later using the WireShark (available for free from www.wireshark.org).

(2) Warnings

• Anything related to policy installation or policy unloading on Security Gateway, will cause FW Monitor to exit.

• It is supported to run only a single instance of FW Monitor at any given time.

• Do not modify Check Point kernel tables used in the security policy while FW Monitor is running. Otherwise, unexpected behavior may result (including a system crash).

• Packets are defragmented as they leave the Security Gateway in both the inbound and outbound directions.

• If SecureXL is enabled on the Security Gateway, then FW Monitor and tcpdump will show only the non-accelerated packets (e.g., 'TCP SYN' will be shown, and 'TCP ACK' will not).

• Important Note: Traffic captures can be misleading when working with SecureXL since both FW Monitor and TCPdump do not always show 'real' packets that are going out to the network. This is related to the way the SecureXL kernel driver is attached to the network adapter itself. When using SecureXL to confirm whether packets are being handled correctly, either capture the traffic on the directly connected router / switch, or disable SecureXL.

• From R80.20 Jumbo Hotfix Accumulator Take 73, the FW Monitor supports monitoring of accelerated traffic by default.

• From R80.20, the FW Monitor can show the traffic accelerated with SecureXL.

• From R80.30 Jumbo Hotfix Accumulator - General Availability Take 215, added ability to FW Monitor to support monitoring of accelerated traffic by default, except for the "-e" flag for FW Monitor, which is not supported on SecureXL.

Monitored traffic

• From R80.20, the 1st accelerated packet is monitored only in the inbound (i).
• From R80.20 Jumbo Hotfix Accumulator Take 73, the accelerated inbound (i) traffic and accelerated outbound (O) traffic is monitored in the Fast Path.
• From R80.20 Jumbo Hotfix Accumulator Take 117, the Slow Path, the Medium Path, and the Fast Path are monitored.
• From R80.30, the default behavior is like before R80.20 Jumbo Hotfix Accumulator Take 72.
• From R80.40 and in R80.30 Jumbo Hotfix Accumulator Take 215 and above, the default behavior is to monitor all traffic.

Filtering options

• From R80.20 Jumbo Hotfix Accumulator Take 73, using the "-e" flag will not filter the accelerated traffic (all accelerated traffic is monitored). To filter the accelerated traffic, use the "-F" flag.

• From R80.20 Jumbo Hotfix Accumulator Take 117, using the "-e" flag will filter out all accelerated traffic. To filter and monitor the accelerated traffic, use the "-F" flag.

• You can freely use the “-F” flag in these versions:

• R80.40 and above

  • R80.30 Jumbo Hotfix Accumulator Take 215 and above
  • R80.20 Jumbo Hotfix Accumulator Take 173 and above

If you use the "-e" flag, the filtering applies to the non-accelerated traffic, and accelerated traffic is not shown at all.

• Important:

A limitation exists when you use filters ("-F" flag for "fw monitor" and "-F" / "-H" flags for "fw ctl debug") for both "fw monitor" and "fw ctl debug" simultaneously. Running any of these commands with a debug filter overrides the debug filter used for pre-existing debug commands.

Currently, it is not supported to run both of these commands simultaneously with a debug filter - "fw monitor -F" and "fw ctl debug -F" / "fw ctl debug -H".

Only the filter for the last command that was run is applied. The data for the previous command will stop being filtered as soon as a new command is run, which means that all data is received unfiltered. This may have significant performance impact.

If you need filtered packet capture during a kernel debug “fw ctl debug” session, we recommend to use "cppcap" ( sk141412) instead of "fw monitor".

(3) FW Monitor Features

In many deployment and support scenarios, capturing network packets is an essential functionality. The tcpdump / snoop utilities are normally used for this task. The FW Monitor utility provides an even better functionality, but omits many of the requirements and the risks associated with these tools:

• No Security Flaws tcpdump / snoop are normally used with NICs in promiscuous mode. Unfortunately, promiscuous mode allows remote attacks against these tools. Check Point's FW Monitor does not use promiscuous mode to capture packets. In addition, most firewalls' operating systems are hardened. In most cases, this hardening includes the removal of tools like tcpdump / snoop, because of their security risks.
• Available on FireWall Installations FW Monitor is a built-in tool that does not need a separate installation, or licensing.
• Multiple Capture Positions within the FireWall Kernel Module Chains FW Monitor allows capturing packets at multiple capture positions within the Security Gateway kernel module chains, both for inbound and outbound packets. This enables to trace a packet through the different layers of the Security Gateway.
• Same Tool and Syntax on All Platforms FW Monitor is available on all different platforms. tcpdump / snoop are often platform-dependent, or have specific "enhancements" on certain platforms. FW Monitor and all its related functionality and syntax are identical across all platforms.

Normally, Check Point kernel modules are used to perform several functions on packets, such as filtering, encryption and decryption, QoS, etc. FW Monitor adds its modules to capture packets. FW Monitor can capture all packets that are seen and/or forwarded by the Security Gateway.

(4) FW Monitor Functionality

There are different inspection points when a packet passes through a Security Gateway.

Note - The Inbound and Outbound traffic direction relates to each specific packet, and not to the connection.

• Inbound:

• Outbound:

Let us examine a TCP handshake in the following topology:

[Client] --- (eth1)[Security Gateway](eth2) --- [Server]

1. TCP SYN from [Client] will pass through Pre-Inbound and Post-Inbound on interface eth1: [Client] --- (eth1) {Pre-Inbound + Post-Inbound} [Security Gateway](eth2) --- [Server]
2. TCP SYN from [Client] will pass through Pre-Outbound and Post-Outbound on interface eth2: [Client] --- (eth1)[Security Gateway] {Pre-Outbound and Post-Outbound} (eth2) --- [Server]
3. TCP SYN-ACK from [Server] will pass through Pre-Inbound and Post-Inbound on interface eth2: [Client] --- (eth1)[Security Gateway] {Pre-Inbound + Post-Inbound} (eth2) --- [Server]
4. TCP SYN-ACK from [Server] will pass through Pre-Outbound and Post-Outbound on interface eth1: [Client] --- (eth1) {Pre-Outbound and Post-Outbound} [Security Gateway](eth2) --- [Server]
5. TCP ACK from [Client] will pass through Pre-Inbound and Post-Inbound on interface eth1: [Client] --- (eth1) {Pre-Inbound + Post-Inbound} [Security Gateway](eth2) --- [Server]
6. TCP ACK from [Client] will pass through Pre-Outbound and Post-Outbound on interface eth2: [Client] --- (eth1)[Security Gateway] {Pre-Outbound and Post-Outbound} (eth2) --- [Server]

Once started, the FW Monitor compiles the INSPECT filter (created as $FWDIR/tmp/monitorfilter.pf) based on the specified syntax (which packets to capture), and loads it to the Check Point kernel (not replacing the Security Policy). The FW Monitor will then continuously get packets from the Check Point kernel, and depending on the syntax, will either display them on the terminal window, or will save them in the output capture file. Upon an interrupt signal (key combination CTRL + C), the FW Monitor stops, unloads the INSPECT filter, and exits.

(5) FW Monitor Syntax and Usage

(5-A) FW Monitor Syntax and Usage - Syntax

• For IPv4:

[Expert@HostName]# fw monitor [-h] [-u|-s] [-i] [-d] [-D] [-t] [{-e <expr>}+ | -f <filter_file_name>|-] [-l length] [-m i|I|o|O] [-x offset[,length]] [-o <output_file_name>] <[-pi position] [-pI position] [-po position] [-pO position] | -p all> [-a] [-ci count] [-co count] [-v VSID] [-w whole packet] [-F "<src IP>,<src port>,<dst IP>,<dst port>,<protocol num>"] [-U]

• For IPv6:

[Expert@HostName]# fw6 monitor [-h] [-u|-s] [-i] [-d] [-D] [-t] [{-e <expr>}+ | -f <filter_file_name>|-] [-l length] [-m i|I|o|O] [-x offset[,length]] [-o <output_file_name>] <[-pi position] [-pI position] [-po position] [-pO position] | -p all> [-a] [-ci count] [-co count] [-v VSID] [-w whole packet] [-F "<src IP>,<src port>,<dst IP>,<dst port>,<protocol num>"] [-U]

Enter the string to filter this table:

(5-B) FW Monitor Syntax and Usage - Syntax comparison between TCPdump and FW Monitor

Note: Refer to https://linux.die.net/man/8/tcpdump.

Enter the string to filter this table:

(5-C) FW Monitor Syntax and Usage - Using the UUID feature

• Background

The purpose of the new FW Monitor feature is to use the UUID feature (that was introduced in the NG AI family) to follow connections passing through the FireWall.

Following connections through the FireWall is not always a trivial task because often the FireWall modifies information in the original packet. These cases include:

• NAT, both Static and Dynamic (Hide)
  • Security Servers
  • VPN Encryption

In Check Point NG AI version, a Universal-Unique-IDentifier (UUID) was introduced as the basis for the log unification mechanism. A UUID is given to every new connection passing through the FireWall. This way, all packets that belong to the connection can be identified and can later be unified on the Security Management Server.

This new infrastructure has given us the ability to enhance the "FW Monitor" utility. The FW Monitor utility is a tcpdump/snoop-like tool that allows us to monitor packets as they pass through the FireWall. The FW Monitor module registers itself as the first and the last module on the chain, allowing us to see any modifications done by the FireWall on the original packet. With the addition of the UUID field to the FW Monitor, entire connections can be monitored as they pass through the FireWall.

• The UUID feature

The original UUID is an array, composed of 4 unsigned 32-bit integers, in which only the first two integers are relevant:

UUID[0] is a timestamp.

UUID[1] is a counter used whenever UUID[0] is not unique.

UUID[2] is the IP address of the local firewall (constant)

UUID[3] is a process number (currently a constant that can be ignored).

The UUID feature can be activated with one of the following switches:

• -u = displays the UUID
  • -s = displays the session UUID, meaning, display a single (parent) UUID of complex connections involving data/control connections (such as FTP, H.323, etc.)

Since we are pressed for space in the header fields of the captured packet, the original UUID has been manipulated to be 1 unsigned long 32-bit integer. It is currently composed of the 2 least significant bytes of UUID[1] (16 bits) attached to the 2 least significant bytes of UUID[0] (16 bits). This gives us the following amount of unique IDs:

• 216 IDs per second
  • 216 seconds

This UUID is then placed in the last four bytes of the Ethernet MAC Source header field.

The new Ethernet header MAC fields are now:

• 2 bytes - i/I/o/O
  • 6 bytes - Interface Name
  • 4 bytes - UUID

In addition, it is possible to redirect the FW Monitor output to an ASCII file instead of saving it in a tcpdump/snoop format. If this is the case, the 32-bit manipulated UUID is displayed as the first field of each line, followed by the entire UUID array.

• Filtering

When viewing the captured file, it is now possible to view the connection by filtering the file by the UUID. This is done by first opening the captured file, finding a packet that belongs to the connection, and getting the last four bytes of the Source MAC address. Then, convert these four bytes to Decimal format and filter the captured file as follows:

# tcpdump -r <captured_file_name> -e -v -xx "ether[8:4] = 0xHHHH"

# snoop -i <captured_file_name> -v -x0 "ether[8:4] = 0xHHHH"

where HHHH is the decimal equivalent of the last four bytes of the Source MAC address.

• Debugging

The UUID feature can be debugged by collecting the "fw ctl debug -m fw + chain conn" debug.

Note: The 'filter' flag may also provide some information, but produces many irrelevant printouts.

• Notes
  • The UUID of the first packet of every new connection before the VM is always 0.
  • The UUID on encrypted packets is also 0.
  • When running the UUID feature and redirecting the output to a captured file, only the first 6 bytes of the interface name will be displayed.
  • The compressed UUID can be similar if taken on two different machines (since the IP address portion of the original UUID was not taken into consideration). In addition, it can also be similar if taken days apart (since the counter portion of the compressed UUID will repeat every 18 hours).

(6) SecureClient Syntax

• SecurRemote and SecureClient R56 / R60 uses an abridged version of FW Monitor - called srfw monitor:

%SRDIR%\bin\srfw monitor [-d] [{-e <expr>}+ | -f <filter_file_name> | -] [-l length] [-m i | I | o | O] [-x offset[,length]] [-o <output_file_name>]

Refer to SecureClient R56 for Mac OS X Release Notes ( Mac OS X 10.3, Mac OS X 10.4) and to Debugging SecuRemote/SecureClient.

• Starting in E75.30, SecurRemote and SecureClient uses command line packet monitoring utility ( PacketMon.exe) - called packetmon:

packetmon [-d] [-h] [-t] [-T] [-i] [-I] [-r] [{-e <expr>}+ | -f <filter_file_name> | -] [-l length] [-m i | I | o | O] [-x offset[,length]] [-o <output_file_name>] [-ci count] [-co count]

Refer to Remote Access Clients for Windows 32/64-bit Administration Guide ( E75.30, E80.41, E80.50) - Chapter 'Monitoring and Troubleshooting' - Troubleshooting the Firewall - Desktop Firewall Monitoring.

(7) Capture Examples of "-e" flag

Refer to the $FWDIR/lib/fwmonitor.def file on the Security Gateway for useful macro definitions.

Note: The "-e" flag is not supported to capture accelerated traffic in these versions:

• R80.40 and above
• R80.30 Jumbo Hotfix Accumulator Take 215 and above
• R80.20 Jumbo Hotfix Accumulator Take 73 and above

(7-A) Capture Examples - Usual Capture

Capture everything, save the data into the file:

[Expert@HostName]# fw monitor -e "accept;" -o /var/log/fw_mon.cap

(7-B) Capture Examples - Host Specific Capture

To specify a host, you can use the following expression:

• Either use " host(<IP_Address_in_Doted_Decimal_format>)", which applies to both Source IP address and Destination IP address

• Or use specific Source IP address " src=<IP_Address_in_Doted_Decimal_format>" and specific Destination IP address " dst=<IP_Address_in_Doted_Decimal_format>"

Examples:

• Capture everything between host X and host Y: [Expert@HostName]# fw monitor -e "host(x.x.x.x) and host(y.y.y.y), accept;" -o /var/log/fw_mon.cap

[Expert@HostName]# fw monitor -e "((src=x.x.x.x , dst=y.y.y.y) or (src=y.y.y.y , dst=x.x.x.x)), accept;" -o /var/log/fw_mon.cap

• Capture everything between hosts X,Z and hosts Y,Z on all Check Point kernel chains: [Expert@HostName]# fw monitor -p all -e "((src=x.x.x.x or dst=z.z.z.z) and (src=y.y.y.y or dst=z.z.z.z)), accept ;" -o /var/log/fw_mon.cap
• Capture everything to/from host X or to/from host Y or to/from host Z: [Expert@HostName]# fw monitor -e "host(x.x.x.x) or host(y.y.y.y) or host(z.z.z.z), accept;" -o /var/log/fw_mon.cap

[Expert@HostName]# fw monitor -e "((src=x.x.x.x or dst=x.x.x.x) or (src=y.y.y.y or dst=y.y.y.y) or (src=z.z.z.z or dst=z.z.z.z)), accept;" -o /var/log/fw_mon.cap

(7-C) Capture Examples - Port-Specific Capture

Note: Port number in the syntax has to be provided in Decimal format. Refer to /etc/services file on the machine, or to http://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml

To specify a port, you can use the following expression:

• Either use " port(<IANA_Port_Number>)", which applies to both Source Port and Destination Port

• Or use specific Source Port " sport=<IANA_Port_Number>" and specific Destination Port " dport=<IANA_Port_Number>"

• In addition:

  • For specific TCP port, you can use " tcpport(<IANA_Port_Number>)", which applies to both Source TCP Port and Destination TCP Port
  • For specific UDP port, you can use " udpport(<IANA_Port_Number>)", which applies to both Source UDP Port and Destination UDP Port

Examples:

• Capture everything to/from port X: [Expert@HostName]# fw monitor -e "port(x), accept;" -o /var/log/fw_mon.cap

[Expert@HostName]# fw monitor -e "(sport=x or dport=x), accept;" -o /var/log/fw_mon.cap

• Capture everything except port X: [Expert@HostName]# fw monitor -e "((sport=!x) or (dport=!x)), accept;" -o /var/log/fw_mon.cap

[Expert@HostName]# fw monitor -e "not (sport=x or dport=x), accept;" -o /var/log/fw_mon.cap

• Capture everything except SSH: [Expert@HostName]# fw monitor -e "((sport!=22) or (dport!=22)), accept;" -o /var/log/fw_mon.cap

[Expert@HostName]# fw monitor -e "not (sport=22 or dport=22), accept;" -o /var/log/fw_mon.cap

[Expert@HostName]# fw monitor -e "not tcpport(22), accept;" -o /var/log/fw_mon.cap

• Capture everything to/from host X except SSH: [Expert@HostName]# fw monitor -e "(host(x.x.x.x) and (sport!=22 or dport!=22)), accept;" -o /var/log/fw_mon.cap

[Expert@HostName]# fw monitor -e "((src=x.x.x.x or dst=x.x.x.x) and (not (sport=22 or dport=22))), accept;" -o /var/log/fw_mon.cap

[Expert@HostName]# fw monitor -e "(host(x.x.x.x) and not tcpport(22)), accept;" -o /var/log/fw_mon.cap

• Capture everything except NTP: [Expert@HostName]# fw monitor -e "not udpport(123), accept;" -o /var/log/fw_mon.cap

(7-D) Capture Examples - Protocol-Specific Capture

Note: Protocol number in the expression has to be provided in Decimal format. Refer to /etc/protocols file on the machine, or to http://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml

To specify a protocol, you can use the following expression:

• Either use " ip_p=<IANA_Protocol_Number>"

Examples:

• To specify TCP protocol with byte offset, use " ip_p=6"

  • To specify UDP protocol with byte offset, use " ip_p=11"
  • To specify ICMP protocol with byte offset, use " ip_p=1"

• Or use " accept [9:1]=<IANA_Protocol_Number>"

(This byte offset syntax is described in the "Capture Examples - Bytes Specific Capture" section)

Examples:

• To specify TCP protocol with byte offset, use " accept [9:1]=6"

  • To specify UDP protocol with byte offset, use " accept [9:1]=11"
  • To specify ICMP protocol with byte offset, use " accept [9:1]=1"

• In addition, you can explicitly use the following expressions to specify protocols:

Examples:

• Capture everything on protocol X: [Expert@HostName]# fw monitor -e "ip_p=X, accept;" -o /var/log/fw_mon.cap
• Everything on protocol X and port Z on protocol Y: [Expert@HostName]# fw monitor -e "(ip_p=X) or (ip_p=Y, port(Z)), accept;" -o /var/log/fw_mon.cap
• Capture everything TCP between host X and host Y: [Expert@HostName]# fw monitor -e "ip_p=6, host(x.x.x.x) or host(y.y.y.y), accept;" -o /var/log/fw_mon.cap

[Expert@HostName]# fw monitor -e "tcp, host(x.x.x.x) or host(y.y.y.y), accept;" -o /var/log/fw_mon.cap

[Expert@HostName]# fw monitor -e "accept [9:1]=6 , ((src=x.x.x.x , dst=y.y.y.y) or (src=y.y.y.y , dst=x.x.x.x));"

[Expert@HostName]# fw monitor -e "ip_p=6, ((src=x.x.x.x , dst=y.y.y.y) or (src=y.y.y.y , dst=x.x.x.x)), accept;" -o /var/log/fw_mon.cap

(7-E) Capture Examples - Protocol Options Specific Capture

Note: Refer to the $FWDIR/lib/tcpip.def file on the Security Gateway.

(7-F) Capture Examples - Byte-Specific Capture

Simple checks are used to check for a value at a specific offset in the packet:

[Expert@HostName]# fw monitor -e "accept [ offset : length , order ] relational-operator value;"

The IP-based protocols are stored in the IP packet as a byte at offset 9:

• To filter based on a Protocol encapsulated into IP, use this syntax: [Expert@HostName]# fw monitor -e "accept [9:1]=<IANA_Protocol_Number>;"

The Layer 3 IP Addresses are stored in the IP packet as double words at offset 12 (Source address) and at offset 16 (Destination address):

• To filter based on a Source IP address, use this syntax: [Expert@HostName]# fw monitor -e "accept [12:4,b]=<IP_Address_in_Doted_Decimal_format>;"
• To filter based on a Destination IP address, use this syntax: [Expert@HostName]# fw monitor -e "accept [16:4,b]=<IP_Address_in_Doted_Decimal_format>;"

The Layer 4 Ports are stored in the IP packet as a word at offset 20 (Source port) and at offset 22 (Destination port):

• To filter based on a Source port, use this syntax: [Expert@HostName]# fw monitor -e "accept [20:2,b]=<Port_Number_in_Decimal_format>;"
• To filter based on a Destination port, use this syntax: [Expert@HostName]# fw monitor -e "accept [22:2,b]=<Port_Number_in_Decimal_format>;"

Examples:

• Capture everything between host X and host Y: [Expert@HostName]# fw monitor -e "accept (([12:4,b]=x.x.x.x , [16:4,b]=y.y.y.y) or ([12:4,b]=y.y.y.y , [16:4,b]=x.x.x.x));"
• Capture everything on port X: [Expert@HostName]# fw monitor -e "accept [20:2,b]=x or [22:2,b]=x;" -o /var/log/fw_mon.cap

(7-G) Capture Examples - Network-Specific Capture

To capture traffic to/from a network, you need to specify the network address and length of network mask (number of bits).

There are 3 options:

Examples:

• Capture everything to/from network 192.168.33.0 / 24: [Expert@HostName]# fw monitor -e "net(192.168.33.0, 24), accept;"
• Capture everything sent to network 192.168.33.0 / 24: [Expert@HostName]# fw monitor -e "to_net(192.168.33.0, 24), accept;"
• Capture everything sent from network 192.168.33.0 / 24: [Expert@HostName]# fw monitor -e "from_net(192.168.33.0, 24), accept;"

(7-H) Capture Examples - Some Examples

• Capture ESP protocol or UDP port 161 (SNMP): [Expert@HostName]# fw monitor -e "(ip_p=50) or (ip_p=17, port(161)), accept;" -o /var/log/fw_mon.cap > /dev/null 2>&1 &
• Filter out the usual garbage (SMTP, POP3, SSH, Microsoft NetBIOS, Check Point ClusterXL CCP): [Expert@HostName]# fw monitor -e "(sport!=25) and (dport!=25) and (sport!=110) and (dport!=110) and (sport!=22) and (dport!=22) and (sport!=137) and (dport!=137) and (sport!=8116) and (dport!=8116), accept;" -o /var/log/fw_mon.cap > /dev/null 2>&1 &
• Filter out the usual garbage (filter in only TCP protocol, and HTTP and HTTPS ports ; filter out the SSH and FW Logs): [Expert@HostName]# fw monitor -e "accept (ip_p=6) and (not (sport=22 or dport=22)) and (not (sport=257 or dport=257)) and ((dport=80 or dport=443) or (sport=80 or sport=443);" -o /var/log/fw_mon.cap > /dev/null 2>&1 &
• Capture Edge communication between 10.10.10.10, or 20.20.20.20, or 30.30.30.30 and on UDP ports 9281, or 9282, or 9283: [Expert@HostName]# fw monitor -e "ip_p=17, (host(10.10.10.10) or host(20.20.20.20) or host(30.30.30.30)) and (port(9281) or port(9282) or port(9283)), accept;" -o /var/log/fw_mon.cap

(8) Capture Examples of "-F" flag

(8-A) Usual Capture

Capture everything, you can use the following expression:

-F "0,0,0,0,0"

(8-B) Host-Specific Capture

To specify a host, you can use the following expression:

-F "x.x.x.x,0,y.y.y.y,0,0"

This will filter for connections with the source IP x.x.x.x and the destination IP y.y.y.y.

Protocol number and port numbers can be any value.

Note: This means the filter will only catch one direction of the connection, so set a second (set of) filter to catch the other direction.

Examples:

• fw monitor -F "x.x.x.x,0,y.y.y.y,0,0"

This will filter connection "x.x.x.x: --> y.y.y.y:, <protocol: Any>"

Source ip: x.x.x.x, source port: any, destination ip: y.y.y.y, destination port: any, protocol: any.

• fw monitor -F "x.x.x.x,0,y.y.y.y,0,0" -F "y.y.y.y,0,x.x.x.x ,0,0"

This will filter connection "x.x.x.x: --> y.y.y.y:, <protocol: Any>" or connection " y.y.y.y: --> x.x.x.x:, <protocol: Any>"

Filter 1: source ip: x.x.x.x, source port: any, destination ip: y.y.y.y, destination port: any, protocol: any.

Filter 2: source ip: y.y.y.y, source port: any, destination ip: x.x.x.x, destination port: any, protocol: any.

(8-C) Port-Specific Capture

To specify ports numbers, you can use the following expression:

-F "0,x,0,y,0"

This will filter connection with source port x and destination port y. Protocol number and ip's can be any value.

Examples:

• fw monitor -F "0,x,0,y,0"

This will filter connection ":x -->:y, <protocol: Any>"

Source ip: any, source port: x, destination ip: any, destination port: y, protocol: any.

• fw monitor -F "x.x.x.x,z,y.y.y.y,0,0" -F "y.y.y.y,0, x.x.x.x ,z ,0"

This will filter connection "x.x.x.x:z --> y.y.y.y:, <protocol: Any>" or connection " y.y.y.y: --> x.x.x.x:z, <protocol: Any>"

Filter 1: source ip: x.x.x.x, source port: z, destination ip: y.y.y.y, destination port: any, protocol: any.

Filter 2: source ip: y.y.y.y, source port: any, destination ip: x.x.x.x, destination port: z, protocol: any.

(8-D) Protocol-Specific Capture

To specify a protocol number, you can use the following expression:

-F "0,0,0,0,x"

This will filter for connections with the protocol number "X".

Port number and IP addresses can be any value.

Examples:

• fw monitor -F "0,0,0,0,x"

This will filter connection ": --> :, <protocol: x>"

Source ip: any, source port: any, destination ip: any, destination port: any, protocol: x.

For example, to capture the GRE traffic (protocol 47): fw monitor -F "0,0,0,0,47"

• fw monitor -F "x.x.x.x,0,y.y.y.y,z,m" -F "y.y.y.y,z, x.x.x.x ,0,m"

This will filter connection "x.x.x.x: --> y.y.y.y:z, <protocol: m>" or connection " y.y.y.y:z --> x.x.x.x:, <protocol: m>"

Filter 1: source ip: x.x.x.x, source port: any, destination ip: y.y.y.y, destination port: z, protocol: m.

Filter 2: source ip: y.y.y.y, source port: z, destination ip: x.x.x.x, destination port: any, protocol: m.

(9) Related Documentation

• Security Gateway Guide

(10) Related Solutions

• sk101878 - CPView Utility

• sk141412 - cppcap - A Check Point Traffic Capture Tooly

• sk43076 - How to work with large traffic capture files

• sk39510 - How to configure Wireshark to show Check Point FireWall chains in an FW Monitor packet

• sk52421 - Ports used by Check Point software

NOTE

This solution has been verified for the specific scenario, described by the combination of Product, Version and Symptoms. It may not work in other scenarios.

Article Properties

Access LevelGeneral

StatusApproved by TAC

Date Created2005-03-02

Last Modified2026-02-15

Was this page helpful?YesNo

Haven't found what you're looking for?

Our customer support team is only a click away and ready to help you 24 hours a day.

Open a Service Request

reCAPTCHA

Recaptcha requires verification.

protected by reCAPTCHA