How to use fw monitor

More documents

Recommendations

Info

Table of Contents ABSTRACT ...................................................................................................................................................................1 ACKNOWLEDGMENTS ................................................................................................................................................4 TYPOGRAPHIC CONVENTIONS USED IN THIS PAPER............................................................................................5 OVERVIEW....................................................................................................................................................................6 COMMAND SYNTAX ....................................................................................................................................................7 Break Sequence........................................................................................................................................................7 Printing the UUID or the SUUID [-u|s] .......................................................................................................................7 Flush standard output [-i]...........................................................................................................................................7 Debugging fw monitor [-d] / [-D] ................................................................................................................................7 Filter fw monitor packets ................................................................................................7 Limit the packet length [-l len]....................................................................................................................................9 Capture masks [-m mask] .........................................................................................................................................9 Print packet/payload data [-x offset[,len]] ..................................................................................................................9 Write output to file [-o ] ...................................................................................................................................10 Insert fw monitor chain module at a specifc position .....................10 Use absolute chain positions [-a] ............................................................................................................................10 Capture a specific number of packets [-ci count] [-co count] ...................................................................................11 Capture on a specific Virtual Router or Virtual Machine [-vs vsid or vsname] .........................................................11 STANDARD USAGE ...................................................................................................................................................12 Using fw monitor .....................................................................................................................................................12 Reading fw monitor output ......................................................................................................................................12 How does fw monitor work? ....................................................................................................................................13 ADVANCED USAGE ...................................................................................................................................................14 Capture masks ........................................................................................................................................................14 Print packet/payload data........................................................................................................................................16 Limit the packet length ............................................................................................................................................17 Using UUIDs and SSIDs .........................................................................................................................................17 How to change the position of the fw monitor chain module ...................................................................................19 fw monitor filters ......................................................................................................................................................30 INSPECT FW MONITOR FILES..................................................................................................................................39 Using snoop to inspect fw monitor files ...................................................................................................................39 Using tcpdump to inspect fw monitor files ...............................................................................................................42 Using Ethereal to inspect fw monitor files................................................................................................................43 Using CPEthereal to inspect fw monitor files...........................................................................................................55 SRFW – FW MONITOR ON THE CLIENT SIDE .........................................................................................................64 How to use fw monitor Page 2 of 70 Revision: 1.01
FW MONITOR ON FIREWALL-1 VSX ........................................................................................................................65 RESOURCES ..............................................................................................................................................................66 Secure Knowledge Links.........................................................................................................................................66 Detecting sniffers on your network ..........................................................................................................................67 snoop ......................................................................................................................................................................67 tcpdump ..................................................................................................................................................................67 Ethereal...................................................................................................................................................................67 CPEthereal..............................................................................................................................................................68 Miscellaneous .........................................................................................................................................................68 REFERENCE...............................................................................................................................................................69 Multicast MAC addresses........................................................................................................................................69 fw monitor file format...............................................................................................................................................69 UUID format ............................................................................................................................................................70 How to use fw monitor Page 3 of 70 Revision: 1.01
Page 1: How to use fw monitor 10-Jul-2003 A
Page 5 and 6: Typographic Conventions used in thi
Page 7 and 8: Command syntax fw monitor [-u|s] [-
Page 9 and 10: Please use ^D (that is Control + D)
Page 11 and 12: Capture a specific number of packet
Page 13 and 14: TCP: 1050 -> 18190 ...PA. seq=bf8bc
Page 15 and 16: By default fw monitor captures pack
Page 17 and 18: Limit the packet length fw monitor
Page 19 and 20: How to change the position of the f
Page 21 and 22: ! The virtual defragmentation may l
Page 23 and 24: Relative position using a Number Th
Page 25 and 26: Relative position using an Alias An
Page 27 and 28: Absolute position Although in most
Page 29 and 30: All positions A new option in NG wi
Page 31 and 32: 1 st Byte 2 nd Byte 3 rd Byte 4 th
Page 33 and 34: 0 8 16 24 32 header length TCP sour
Page 35 and 36: Logical and Relational Operators In
Page 37 and 38: src for example is defined as ip_sr
Page 39 and 40: Inspect fw monitor files The recomm
Page 41 and 42: ash-2.03# snoop -v -c 1 -i fwmonito
Page 43 and 44: Using Ethereal to inspect fw monito
Page 45 and 46: The pane in the middle shows protoc
Page 47 and 48: Ethereal fw monitor additions Alfre
Page 49 and 50: Activate the FW-1 chain column The
Page 51 and 52: Using display and color filters on
Page 53 and 54:
Other useful expressions are: Field
Page 55 and 56:
Using CPEthereal to inspect fw moni
Page 57 and 58:
NAT Highlighting Following a connec
Page 59 and 60:
Because some problems (missing at
Page 61 and 62:
Block Filters Block filters allow y
Page 63 and 64:
A new feature in NG with Applicatio
Page 65 and 66:
fw monitor on FireWall-1 VSX If you
Page 67 and 68:
Detecting sniffers on your network
Page 69 and 70:
Reference Multicast MAC addresses S
show all

How to use fw monitor

Create successful ePaper yourself

Delete template?

Save as template?