Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
Absolute position<br />
Although in most cases the <strong>use</strong> of aliases for positioning is recommended it is also possible <strong>to</strong> <strong>use</strong><br />
absolute positioning. This allows you <strong>to</strong> specify the position <strong>to</strong> insert the <strong>fw</strong> moni<strong>to</strong>r module using its<br />
absolute position. Every chain module as such a position and the kernel sorts them according <strong>to</strong> this<br />
position. The absolute position is printed in hex after the relative position. Please note that chain positions<br />
before the virtual machine are negative values:<br />
[Expert@cpmodule]# <strong>fw</strong> ctl chain<br />
in chain (9):<br />
0: -7f800000 (ca8d9698) IP Options Strip (ipopt_strip)<br />
1: - 2000000 (cb1c1c64) vpn decrypt (vpn)<br />
2: - 1fffff6 (ca8da0f8) Stateless verifications (asm)<br />
3: - 1fffff0 (cb1c17f0) vpn decrypt verify (vpn_ver)<br />
4: - 1000000 (ca8eb688) SecureXL connection syn (secxl_sync)<br />
5: 0 (ca8aa0c0) <strong>fw</strong> VM inbound (<strong>fw</strong>)<br />
6: 2000000 (cb1c2aa0) vpn policy inbound (vpn_pol)<br />
7: 10000000 (ca8eb728) SecureXL inbound (secxl)<br />
8: 7f800000 (ca8d98e4) IP Options Res<strong>to</strong>re (ipopt_res)<br />
out chain (8):<br />
0: -7f800000 (ca8d9698) IP Options Strip (ipopt_strip)<br />
1: - 1ffffff (cb1c16fc) vpn nat outbound (vpn_nat)<br />
2: - 1f00000 (ca8da0f8) Stateless verifications (asm)<br />
3: 0 (ca8aa0c0) <strong>fw</strong> VM outbound (<strong>fw</strong>)<br />
4: 2000000 (cb1c26e0) vpn policy outbound (vpn_pol)<br />
5: 10000000 (ca8eb728) SecureXL outbound (secxl)<br />
6: 20000000 (cb1c2164) vpn encrypt (vpn)<br />
7: 7f800000 (ca8d98e4) IP Options Res<strong>to</strong>re (ipopt_res)<br />
Figure 23: <strong>fw</strong> ctl chain – absolute positions<br />
! Please note that the absolute position is a property of the kernel module assigned by Check Point<br />
R&D: This value may change in future versions.<br />
<strong>How</strong> <strong>to</strong> <strong>use</strong> <strong>fw</strong> moni<strong>to</strong>r Page 27 of 70<br />
Revision: 1.01
Change language