Using System Tools
Quantum Spark 1500, 1600, and 1800 Appliances R81.10.X Locally Managed Administration Guide|51
Action Description
Tcpdump Tool Opens a popup window, in which you can capture traffic that passes through
appliance interfaces.
Notes
n
The appliance runs the tcpdump command with the specified
parameters.
The Check Point traffic capture tool "fw monitor" is available through
the command line interface.
See the:
l
Quantum Spark R81.10.X CLI Reference Guide for 1500, 1600,
1800 Appliances
> Chapter "Miscellaneous Commands" > Section
"fw commands".
l
R81.10 CLI Reference Guide
> Chapter "Security Gateway
Commands" > Section "fw" > Section "fw monitor".
n
You can view the captured traffic in real time or save it into a file (plain-
text format "*.log" or Wireshark format "*.cap").
n
When you start a new traffic capture and save it into a file, the appliance
overwrites the previous capture file (if it exists).
WebUI shows a note with the date of the existing file and you can
download it before you start a new traffic capture.
n
The appliance captures traffic only on interfaces with a configured IP
address.
n
You can start the traffic capture and go to other WebUI pages while the
packet capture runs in the background.
However, the packet capture stops automatically if the WebUI session
ends.
Make sure you return to the traffic capture page, stop the capture, and
download the capture result file before you end the WebUI session.
Procedure
1. Click the Tcpdump Tool button.
2. In the top left corner, select the applicable interface - All interfaces
(default), WAN, LAN1, and so on.
3. Optional: Configure the applicable filters:
a. In the Host field, enter the applicable IP address.
b. In the Port field, enter the applicable port number (see
IANA Service
Name and Port Number Registry
).
c. In the Count field, enter the applicable number of packets to capture.
To Next Page
