Home / server / Questions / 54941
Accepted
Cian
Asked: 2009-08-18 03:22:23 +0800 CST

Checkpoint FW1 logging

  • 772

When I view the logs created for my checkpoint fw1, does it log connections on receiving the syn, or does it wait till the three way handshake completes? If it logs after the syn, is there anyway of telling where the three way handshake has not completed?

firewall

2 Answers

  1. I guess it logs when it receive the SYN, you could easily verify this by just sending a syn with a tool like hping.
    If you want to see the three way handshake I would recommand to use fw monitor, there is good pdf about it on checkpoint website.
    The quick step is to run something like fw monitor -e 'accept src=1.2.3.4 or dst= 1.2.3.4;'

    Edit: Of course, this as to be done in live, so it's not as good as logging...

    • 1
  2. Best Answer

    The initial log is queued/initially defined upon SYN_RECV for a standard traffic log without accounting.

    With accounting enabled, the accounting log counters are then retained and forwarded to the log module for completion of the log record. A complete accounting log record would include the initial access log + some accounting details of the recorded session or virtual session.

    • 1