fw ctl zdebug Builderv0.4.2

Build Check Point fw ctl zdebug drop commands with chained grep filter pipelines. Narrows real-time kernel drop output to matching source/destination addresses, ports, protocols, and drop reasons. Supports VSX virtual system targeting, stop-on-string, kernel debug filters, and INSPECT filters. Run in expert mode on the gateway or Security Management Server.

// generated command

$ fw ctl zdebug drop

// zdebug options

Include PPAK drops (+)

VSX

Virtual Systems (-v)

Comma-separated VS IDs — limits debug to specified virtual systems

-k Include kernel / SecureXL entities not bound to a specific VS

STOP / FILTER

Stop on string (-s)

Debug halts when this string appears in output — run fw ctl debug 0 afterward to reset flags and avoid performance impact

Debug string filter (-d)

Comma-separated — plain terms are included, ^-prefixed terms are excluded · e.g. error,conn,^RST shows messages with "error" or "conn" but not "RST" · more efficient than post-processing with grep

ADVANCED FLAGS

Frequency threshold (-f)

Distinct frequencies only in the 'VPN' module — no effect on other modules

INSPECT filter (-e)

FireWall-only — does not filter SecureXL debug (use -F for that)

Kernel debug filter (-F)

Also filters SecureXL debug · see Security Gateway Guide › Kernel Debug Filters

Debug filter (-H)

See Security Gateway Guide › Kernel Debug Filters

CAPTURE TO FILE

Uses tee — output appears on screen and is saved simultaneously · use default path · clear

// grep filters

Each filter adds a grep stage to the pipeline. All active filters must match (AND logic). Fields left empty are skipped. Because zdebug is free-form kernel text, IP filters match the address anywhere in the line — combine source and destination filters for precise flow matching.

Protocol

Drop Reason

Case-insensitive substring match — grep -i

Interface

Matches interface name in zdebug output