How to use fw monitor

Limit the packet length
fw monitor can limit the amount of packet data which will be read from the kernel. The option –l is
used for this purpose. fw monitor will only read as many bytes from the kernel as you specified for the
–l option. Please make sure to capture as least as many bytes so that the IP and transport headers are
included.
Using UUIDs and SSIDs
UUIDs (universal-unique-identifiers) are a new feature in NG. The firewall assigns an UUID to every
connection passing the firewall. This UUID is kept through all firewall operations. Therefore you can follow
a connection through the firewall even if the packet content is NAT’ed. The UUID is also kept in the
connection table entry for the connection.
Additionally there is the concept of an SUUID (Session UUID). For services which are using several
connections (e.g. FTP) every connection has a unique UUID but the SUUID is equal for all the
connections (it’s the same as the first/control connection’s UUID).
UUIDs and SUIDs are very helpful for tracking connection through different chain modules of the firewall.
Even if a connection is NAT’ed the UUID or SUID remains the same. Therefore filtering for the UUID or
SUID helps you to find all packets belonging to a connection or session, even if the packets change.
Please note that the first packet of a connection or session as no UUID or SUID assigned yet (SUID/SUID
is all zero). After the first packet has been processed by the firewall a UUID or SUID is assigned and will
remain the same for the whole connection/session.
An UUID is built from four 32bit values using a timestamp, a counter, the firewall IP address and a
process ID. From this 128bit value a smaller 32bit value is constructed which is printed as well. Please
refer to UUID format for detailed information.
The UUID/SUUID is printed in front of the IP information. The first value is the striped UUID (32bit). The
second value is the complete UUID (128bit).
How to use fw monitor Page 17 of 70
Revision: 1.01