fw monitor -e doesn't work

[pookicat]

Hi,

I'm running secureplatform ngx r61.

I'd like to capture the traffic with fw monitor for only specified source or destination address.

according to the fw monitor document at checkpoint, this syntax should work :
fw monitor -e 'accept src=1.2.3.4 or dst=1.2.3.4'

but the monitor exits with the following code :
monitorfilter :
"/opt/CPsuite-R61/fw1/tmp/monitorfilter.pf", line3 : ERROR: syntax error
Compilation failed.
monitor : filter compilation failed /opt/CPsuite-R61/fw1/tmp/monitorfilter

has anyone ever tried (and managed) to run fw monitor on secure platform ?

thanks

[kva.kva]

You forget ";".

fw monitor -e "accept src=1.2.3.4 or dst=1.2.3.4;"

[pookicat]

so easy.

thanks a lot.

next time I'll RCTFM (read Carefully etc.)

[mckenng]

Running SPLAT R55 If I do the same I stiull get an Illegal command

fw monitor -e "accept src=1.2.3.4 or dst=3.4.2.1;"
Illegal command

any ideas is the syntax different in R55?

[melipla]

Try it like this:

fw monitor -e "accept ((src=1.2.3.4) or (dst=3.4.2.1));"

[chillyjim]

Also make sure you are in expert mode or it won't work either and generates a syntax error.