How to use fw monitor

srfw – fw monitor on the client side
SecuRemote/SecureClient since Feature Pack 3 includes an utility named “srfw” which provides some
functionality of the fw command on the client side. One functionality is to capture packets on the client
side with srfw monitor like it is possible on the gateway side with fw monitor. The binary
(srfw.exe) is located under $SRDIR\bin (normally C:\Program
Files\CheckPoint\SecuRemote\bin). The general syntax is:
srfw monitor [-d] [-l len] [-m mask]
[-x offset[,length]] [-o file]
Figure 79: srfw monitor syntax
The usage of srfw monitor (e.g. the Break Sequence) and the options are the same as the fw
monitor options.
Figure 80: srfw monitor example – four ICMP echo requests/replies on a german Windows XP
! Please note that although srfw monitor understands most of the fw monitor command line
switches not every switch is implemented. You can use some switches (e.g. –e and –f) with srfw
monitor (srfw monitor isn’t even complaining about it!), but they simply perform no actual
function. But this can change in future versions of SecuRemote/SecureClient.
How to use fw monitor Page 64 of 70
Revision: 1.01