capture traffic on outbound

[Don_Doc]

As am using checkpoint R77, I have task to create rule for client to access a server, which I have done
The client has a Natted IP address.
I feel I have completed the task but something is still not right.
I was ask to capture traffic; I was able to capture the Inbound interface traffic (which says traffic is getting into out firewall) but cant seems capture the outbound interface either from src or natted dst.

What steps can I take to resolve this?

[mcnallym]

As am using checkpoint R77, I have task to create rule for client to access a server, which I have done
The client has a Natted IP address.
I feel I have completed the task but something is still not right.
I was ask to capture traffic; I was able to capture the Inbound interface traffic (which says traffic is getting into out firewall) but cant seems capture the outbound interface either from src or natted dst.

What steps can I take to resolve this?

Is this a Server being accessed from the Internet, in which case use something like this

fw monitor -e "accept((dst=server_natted_ip or dst=server_ip) or (src=server_natted_ip or src=server_ip));"

should show you any traffic destined for either of the ip wether is source or destination.

Should show the 4 stages of inbound and outbound along with the reply

That or try

fw ctl zdebug + drop | grep server_natted_ip

if nothing shows up try

fw ctl zdebug + drop | grep server_ip

[Don_Doc]

Is this a Server being accessed from the Internet, in which case use something like this

fw monitor -e "accept((dst=server_natted_ip or dst=server_ip) or (src=server_natted_ip or src=server_ip));"

should show you any traffic destined for either of the ip wether is source or destination.

Should show the 4 stages of inbound and outbound along with the reply

That or try

fw ctl zdebug + drop | grep server_natted_ip

if nothing shows up try

fw ctl zdebug + drop | grep server_ip

.................................................. .................................................. .....
Thanks for the response

I have tried the below, sent it over and got the response was( Traffic is getting into your firewall and we can only see TCP SYN - "This is inbound interface. We need to see if the traffic is leaving your firewall.
You should capture traffic on outbound interface where .XXX.XX3 is to capture for either source or natted destination


[Expert@Chkpt-FW2:0]# tcpdump -i eth3 | grep 1x8.xx5.xx.2xx
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth3, link-type EN10MB (Ethernet), capture size 96 bytes
13:38:01.933992 IP 1x8.xx5.xx.2xx.51338 > xx5.2xx.xx.xx1.ssh: S 4008206647:40082
06647(0) win 29200 <mss 1460,sackOK,timestamp 604917298 0,nop,wscale 1>
13:38:02.931823 IP 1x8.xx5.xx.2xx.51338 > xx5.2xx.xx.xx1.ssh: S 4008206647:40082

Any more advise will be appreciated

Thanks

[Don_Doc]

If its a routing issues, what steps would i take to identify and rectify the issue.

[mcnallym]

If its a routing issues, what steps would i take to identify and rectify the issue.

If you do an fw monitor then will show the Interfaces involved

you can also run the command in clash


show route destination w.x.y.z

This will show the next hop that would be used for that specific destination