TCPdump vs FW Monitor
What specific type of packets does the following TCPDUMP command capture? tcpdump -nni 'tcp[tcpflags] & 4 = 4'
Can you get the same results from the “fw monitor” command and if so, what is that command?
Tell me more
×
IT Security Stack Exchange is a question and answer site for
IT security professionals. It's 100% free, no registration required.
|
closed as not a real question by Terry Chia, Polynomial, schroeder, Scott Pack, Gilles Oct 4 '12 at 19:25
It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, see the FAQ.
|
That tcpdump command should look for packets with the reset flag set I believe. You can get the same result from inspect code but it's much more difficult and usually you get the same result with TCPDUMP. Here is a page on inspect code that may help if you really want to try it, however I'd be cautious about trying it as you could impact your firewall performance. Checkpoint have done a good job at keeping inspect code a black art that only they really know how to do well. tcpdump is a network utility that captures packets from a specific interface. FW Monitor is a packet-level debugger built into the checkpoint fw process, it allows you to see packets as they do through the different stages of processing. With tcpdump you see a single entry for a packet, it is either coming in or going out of the interface, with fw monitor you see the packet at all 4 stages of the firewall process which are pre-in, post-in, pre-out, post-out. I've rarely needed to use inspect code but when I have it has been insightful. For the most part looking at tcpdump and the log viewer does the trick. A handy tool for generating basic inspect code is ginspect, although it doesn't go to the level of looking that deep into the packet header. |
|||
|
|
