Check Point fw monitor Packet Capture Guide

tcpdump tells you what arrives on an interface. fw monitor tells you what happens to a packet inside the firewall — at every chain module it passes through, in both directions, on every virtual system. That distinction is what makes it the right tool when you need to prove where Check Point is dropping traffic: pre-inbound, post-inbound, pre-outbound, or post-outbound. This guide covers the capture masks, filter expressions, the flags that matter, and how to read the output to localise a drop to a specific inspection point.

The Four Inspection Points

Traffic on a Security Gateway passes through chain modules on the way in and on the way out. fw monitor can capture at each position, selected with the -m flag:

• -m i — Pre-Inbound, before the packet enters the inbound chain module.
• -m I — Post-Inbound, after inbound processing.
• -m o — Pre-Outbound.
• -m O — Post-Outbound.
• -m e / -m E — the corresponding encrypted/decrypted positions for VPN traffic.

Capturing at a single point answers one question; capturing at all four shows the packet's whole journey. The letters q and Q appended to a mask indicate that a QoS policy applies at that interface.

Basic Capture Syntax

Run fw monitor from the expert shell on the gateway. Only one instance may run at a time, which is the most common cause of a "capture failed" error:

[Expert@GW:0]# fw monitor
[Expert@GW:0]# fw monitor -e "accept src=10.10.1.5 and dst=203.0.113.10;"
[Expert@GW:0]# fw monitor -m i -ci 3
[Expert@GW:0]# fw monitor -v 4 -e "accept;" -o /var/log/fw_mon.cap

Key flags worth knowing:

• -e <expression> — an INSPECT filter expression applied on the command line. Use accept; to capture everything, or add match terms to narrow it.
• -f <file> — read the filter expression from a file, which keeps the internal buffer from filling too quickly and is easier to reuse.
• -ci / -co — stop after counting a number of inbound or outbound packets. Combine both for a bounded capture.
• -o <file> — write the capture to a file that can be opened in Wireshark.
• -w — capture the entire packet rather than the header only; must be used with -o or -x.
• -x <offset>[,<length>] — capture only a slice of each packet, which is how you limit volume when you only need headers plus a few payload bytes.
• -T — print a timestamp for each packet, which is required if you want to correlate with logs.
• -U — stop a running fw monitor from another shell.

Capturing a Specific Flow

Filtering to a single flow

Always narrow the capture with a filter. An unfiltered fw monitor on a busy gateway fills screens in seconds and can slow the gateway:

[Expert@GW:0]# fw monitor -T -e "accept (src=10.10.1.5 and dst=203.0.113.10) or (src=203.0.113.10 and dst=10.10.1.5);"

Capture minimal bytes unless you need payload — enough for the Layer 3 IP header and the Layer 4 transport header is usually enough to diagnose a drop:

[Expert@GW:0]# fw monitor -T -x 96 -e "accept src=10.10.1.5 and dst=203.0.113.10;"

To a file, for later analysis in Wireshark, with a bounded packet count so the capture ends on its own:

[Expert@GW:0]# fw monitor -ci 2000 -o /var/log/fw_mon_20260920.cap -e "accept src=10.10.1.5;"

Reading the Output to Localise a Drop

Each output line shows a lowercase or uppercase position letter. The convention is that lowercase marks the position of the packet in the inbound direction and uppercase in the outbound direction. To find a drop, look for a packet that appears at one position but not at the next:

monitor: [i] eth1:i 10.10.1.5 -> 203.0.113.10 TCP 12345 -> 443 SYN
monitor: [I] eth1:i 10.10.1.5 -> 203.0.113.10 TCP 12345 -> 443 SYN

If a packet is visible at i but not at I, it was dropped during inbound processing — a security policy, an anti-spoofing check, or a SmartDefense/IPS verdict. If it appears at I but not at o, the routing decision failed and there is no route, which is the check to run next. If it reaches O but never leaves the physical interface, look at ARP resolution for the next hop.

Isolating a single virtual system

By default, fw monitor captures traffic in the FireWall Virtual Machine module and across all Virtual Systems and Virtual Routers. On VSX or a multi-VS gateway, add -v <id> to isolate a single virtual system:

[Expert@GW:0]# fw monitor -v 4 -e "accept;" -o /var/log/fw_mon.cap

Operational Notes

• Only one fw monitor instance can run at a time; kill the old one with fw monitor -U rather than restarting the gateway.
• Always filter — an unfiltered capture is a performance risk on a production gateway.
• Use -f with a filter file on busy gateways so the internal buffer does not overflow and drop the packets you actually need.
• Capture headers only unless payload is required, and use -ci/-co to bound the capture automatically.
• For accelerated traffic, only the default inbound and outbound positions apply — the other masks are ignored.

Related reading: our Palo Alto CLI troubleshooting commands guide, the FortiGate debug flow packet trace guide, and the tcpdump advanced filter examples article.

原文链接：https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_CLI_ReferenceGuide/Topics-CLIG/FWG/fw-monitor.htm