1

When I view the logs created for my checkpoint fw1, does it log connections on receiving the syn, or does it wait till the three way handshake completes? If it logs after the syn, is there anyway of telling where the three way handshake has not completed?

1
  • It's worth ntoing that you can tell if the three way handshake completed by changing the log rule to an account rule, which will tell you how much traffic passed as part of the connection.
    – Cian
    Sep 3, 2010 at 14:08

2 Answers 2

1

The initial log is queued/initially defined upon SYN_RECV for a standard traffic log without accounting.

With accounting enabled, the accounting log counters are then retained and forwarded to the log module for completion of the log record. A complete accounting log record would include the initial access log + some accounting details of the recorded session or virtual session.

1

I guess it logs when it receive the SYN, you could easily verify this by just sending a syn with a tool like hping.
If you want to see the three way handshake I would recommand to use fw monitor, there is good pdf about it on checkpoint website.
The quick step is to run something like fw monitor -e 'accept src=1.2.3.4 or dst= 1.2.3.4;'

Edit: Of course, this as to be done in live, so it's not as good as logging...

2
  • Yeah, unfortunately the problem I'm currently trying to debug isn't ongoing, so I need to see if the connections were being established in logs :-(
    – Cian
    Aug 17, 2009 at 11:41
  • Checked this, it does log the connection once it receives a syn.
    – Cian
    Sep 7, 2009 at 16:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .