How to use fw monitor

Acknowledgments
Due to many questions and requests regarding fw monitor we developed the idea to write a “short”
paper about fw monitor. We thought 15-20 pages would be more than enough to cover all important
aspects of fw monitor …
As we started to collect information about fw monitor and related topics we soon discovered that there
was much more to write about than we initially thought. We had two choices: Writing a short note much
like a man page or choosing the long way and write a comprehensive manual. We decided for the second
and this paper is the result.
No way could we have completed this paper without the awesome help of many people who give us
invaluable feedback. We would like to thank Shaul Eizikovich for his fabulous CPEthereal; Misha Pak for
giving us deep insight in many fw monitor functionalities and mechanisms; Lior Cohen, Tal Manor and
Mark Wellins from Solutions Center for their great ongoing support; Joe Green for pointing us to missing
details we totally overlooked; our colleagues in the german Check Point Office who kept us working on
the paper by asking permanently for the final version; Alfred Köbler (ICON Systems GmbH) for initially
adding fw monitor decoding support to Ethereal, Manuela Menges (BASF IT Services GmbH) for
comments which where nearly as long as the whole document and to all others which provided comments
and suggestions.
How to use fw monitor Page 4 of 70
Revision: 1.01