Use "fw monitor" to monitor traffic from 1 host.

[Wutkung]

What is the parameter for "fw monitor" if I want to monitor all traffic from 1 host.

And if I want to monitor only VPN traffic from 1 host. Can I use "fw monitor" to monitor it ? and what is the parameter ?

Best Regards,

[abusharif]

there are many 'features' in fw monitor. Would recommend u reading fw monitor guide that can be downloaded from checkpoint. Lot of "tweaking and filtering" can be done. Basic what you ask for to see traffic from a host:

fw monitor -e 'accept src=x.x.x.x;'

[kna_raghu]

Best reference is the Checkpoint guide to fw monitor. You can download this from http://www.checkpoint.com/techsuppor...or_rev1_01.pdf. If you want to see ALL traffic for a single host then do the following:

fw monitor -e "accept src=x.x.x.x or dst=x.x.x.x;"