up vote 1 down vote favorite
share [g+] share [fb]

When I view the logs created for my checkpoint fw1, does it log connections on receiving the syn, or does it wait till the three way handshake completes? If it logs after the syn, is there anyway of telling where the three way handshake has not completed?

link|improve this question
60% accept rate
It's worth ntoing that you can tell if the three way handshake completed by changing the log rule to an account rule, which will tell you how much traffic passed as part of the connection. – Cian Sep 3 '10 at 14:08
feedback

1 Answer

up vote 1 down vote accepted

I guess it logs when it receive the SYN, you could easily verify this by just sending a syn with a tool like hping.
If you want to see the three way handshake I would recommand to use fw monitor, there is good pdf about it on checkpoint website.
The quick step is to run something like fw monitor -e 'accept src=1.2.3.4 or dst= 1.2.3.4;'

Edit: Of course, this as to be done in live, so it's not as good as logging...

link|improve this answer
Yeah, unfortunately the problem I'm currently trying to debug isn't ongoing, so I need to see if the connections were being established in logs :-( – Cian Aug 17 '09 at 11:41
Checked this, it does log the connection once it receives a syn. – Cian Sep 7 '09 at 16:24
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.