Packet capture in Firewall Logs?

[jchrisos]

Is there an option or a way to capture a packet(s) for each event in the SmartView Tracker logs?

[kva.kva]

Command "fw monitor"?

[jchrisos]

Originally Posted by kva.kva

Command "fw monitor"?

Thanks for the reply. Where do you issue this command? Will it allow packet captures to show up in SmartView Tracker?

Thanks again!

[david]

fw monitor is a command line utility.
are you wanting to open a capture file to view in smartracker? this is not possible.

you can use tcpdump & redirect the output to a file, then open with a tool such as ethereal to view/analyse 'offline'

[jchrisos]

Originally Posted by david

fw monitor is a command line utility.
are you wanting to open a capture file to view in smartracker? this is not possible.

you can use tcpdump & redirect the output to a file, then open with a tool such as ethereal to view/analyse 'offline'

I was looking more for packet(s) related to an event that was dropped and thus shows up in my logs.

For example, lets say I deny outbound http access and log the drops. Then a user went to www.google.com. I would like to be able to see the actual packet of the http fetch to www.google.com from this user.

Is that possible?

Thanks for the reply btw.

[Porter]

http://checkpoint.com/techsupport/do...nitor%20pdf%22

fw monitor shows you everthing