fw monitor Builderv0.4.1

Build Check Point fw monitor capture commands. Packets are intercepted at kernel inspection points before and after the security policy — a packet that disappears between points was dropped at that stage.

// generated command

$ fw monitor -m iIoO -u -e "accept;"

// capture options

Packet Count (-c)

Output File (-o)

pcap readable by Wireshark · use default path · clear

-u Disable DNS hostname resolution

// inspection points (-m)

fw monitor intercepts packets at four kernel checkpoints. Enable the points you need — a packet that disappears between points was dropped at that stage of processing.

i Pre-inbound — arrives at the interface, before security policy inspection I Post-inbound — accepted by security policy, forwarded into the network o Pre-outbound — before security policy on the outbound path O Post-outbound — exits the interface, after all outbound inspection

// filter expression (-e)

Protocol