How to use fw monitor

0 8 16 24 32
header
length
TCP source port number
reserved
Figure 33: IP protocols – TCP header
TCP sequence number
TCP acknoledgment number
FYN
SYN
RST
PSH
ACK
URG
TCP options (if any)
TCP destination port number
TCP window size
TCP checksum TCP urgent pointer
TCP payload (if any)
Simple Checks can be used for a wide variety of checks. Some examples:
Filter on source or destination IP address. The IP addresses are stored as dwords at offset 12 (source
address) and 16 (destination address):
address filter expression
source accept [12, b]=172.16.1.2;
destination accept [16, b]=10.2.4.12;
Figure 34: fw monitor simple checks – IP addresses
! Please note the use of IP addresses instead of simple numbers in the example above. INSPECT
“knows” IP addresses and converts them automatically to an integer. There is no need to do this
manually although this is possible. Please refer to the Check Point Reference Guide for more
information.
Filter on the IP protocol. The IP protocol is stored as a byte at offset 9 in the IP packet:
IP protocol filter expression
ICMP accept [9:1] = 1;
TCP accept [9:1] = 6;
UDP accept [9:1] = 17;
ESP accept [9:1] = 50;
Figure 35: fw monitor simple checks – IP protocol examples
How to use fw monitor Page 33 of 70
Revision: 1.01