Best reference is the Checkpoint guide to fw monitor. You can download this from
http://www.checkpoint.com/techsuppor...or_rev1_01.pdf. If you want to see ALL traffic for a single host then do the following:
fw monitor -e "accept src=x.x.x.x or dst=x.x.x.x;"