fw monitor (UUID vs. SUUID)

[runcmd]

Using the CLI, the "fw monitor" command allows you to specify a parameter of "-u" for UUID or "-s" for SUUID. Could anyone please clarify for me, what's the difference between UUID (Universally Unique Identifier?) and SUUID (Session Universal Unique Identifier?)? Thanks!

[kva.kva]

From "fw monitor" guide - http://www.checkpoint.com/techsuppor...or_rev1_01.pdf
"UUIDs (universal-unique-identifiers) are a new feature in NG. The firewall assigns an UUID to every connection passing the firewall. This UUID is kept through all firewall operations. Therefore you can follow a connection through the firewall even if the packet content is NAT’ed. The UUID is also kept in the connection table entry for the connection.
Additionally there is the concept of an SUUID (Session UUID). For services which are using several connections (e.g. FTP) every connection has a unique UUID but the SUUID is equal for all the connections (it’s the same as the first/control connection’s UUID)."

[runcmd]

This is EXACTLY what I was looking for! The document I was looking at is specifically for the CLI. Thanks so much for the help! The link to the documentation was also extremely useful. Thanks, again!