How to use fw monitor

Inspect fw monitor files
The recommended tool for analyzing fw monitor capture files is Ethereal (Using Ethereal to inspect fw
monitor files) or CPEthereal (Using CPEthereal to inspect fw monitor files). Nevertheless fw monitor
capture files can be inspected with every tool which is able to read the snoop file format (Snoop file
format (RFC 1761)).
Using snoop to inspect fw monitor files
snoop is a tool normally found on Sun Solaris machines. snoop allows you to capture packets and to
examine them. As described in Write output to file fw monitor writes its capture files in the file format
used by snoop. This allows us to use snoop to decode the files later on. This means you can generate
the fw monitor files on one machine and examine them on another machine using all of snoop’s
functions including verbose output and filtering.
! snoop is only available on Sun Solaris. For other platforms refer to Using tcpdump to inspect fw
monitor files or Using Ethereal to inspect fw monitor files.
The following example shows how an fw monitor capture file (two ICMP Echo Request and ICMP Echo
Replies, PreIn/PostIn and PreOut/PostOut) which was generated on a Linux machine is inspected on a
Sun:
bash-2.03# snoop -i fwmonitor.cap
1 0.00000 172.16.1.1 -> 172.16.1.2 ICMP Echo request (ID: 51470 Sequence number: 256)
2 0.00000 172.16.1.1 -> 172.16.1.2 ICMP Echo request (ID: 51470 Sequence number: 256)
3 0.00000 172.16.1.2 -> 172.16.1.1 ICMP Echo reply (ID: 51470 Sequence number: 256)
4 0.00000 172.16.1.2 -> 172.16.1.1 ICMP Echo reply (ID: 51470 Sequence number: 256)
5 0.00000 172.16.1.1 -> 172.16.1.2 ICMP Echo request (ID: 51470 Sequence number: 512)
6 0.00000 172.16.1.1 -> 172.16.1.2 ICMP Echo request (ID: 51470 Sequence number: 512)
7 0.00000 172.16.1.2 -> 172.16.1.1 ICMP Echo reply (ID: 51470 Sequence number: 512)
8 0.00000 172.16.1.2 -> 172.16.1.1 ICMP Echo reply (ID: 51470 Sequence number: 512)
Figure 48: Inspecting fw monitor files with snoop
How to use fw monitor Page 39 of 70
Revision: 1.01