Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When I view the logs created for my checkpoint fw1, does it log connections on receiving the syn, or does it wait till the three way handshake completes? If it logs after the syn, is there anyway of telling where the three way handshake has not completed?

share|improve this question
    
It's worth ntoing that you can tell if the three way handshake completed by changing the log rule to an account rule, which will tell you how much traffic passed as part of the connection. –  Cian Sep 3 '10 at 14:08

2 Answers 2

up vote 1 down vote accepted

The initial log is queued/initially defined upon SYN_RECV for a standard traffic log without accounting.

With accounting enabled, the accounting log counters are then retained and forwarded to the log module for completion of the log record. A complete accounting log record would include the initial access log + some accounting details of the recorded session or virtual session.

share|improve this answer

I guess it logs when it receive the SYN, you could easily verify this by just sending a syn with a tool like hping.
If you want to see the three way handshake I would recommand to use fw monitor, there is good pdf about it on checkpoint website.
The quick step is to run something like fw monitor -e 'accept src=1.2.3.4 or dst= 1.2.3.4;'

Edit: Of course, this as to be done in live, so it's not as good as logging...

share|improve this answer
    
Yeah, unfortunately the problem I'm currently trying to debug isn't ongoing, so I need to see if the connections were being established in logs :-( –  Cian Aug 17 '09 at 11:41
    
Checked this, it does log the connection once it receives a syn. –  Cian Sep 7 '09 at 16:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.