Mark, Thanks for your answer. Is this command also a risk " fw ctl debug + drop" with a cpu level?
-----Original Message----- From: Mailing list for discussion of Firewall-1 [mailto:[EMAIL PROTECTED] On Behalf Of Mark Elsen Sent: dinsdag 5 augustus 2008 10:54 To: [email protected] Subject: Re: [FW-1] 100 cpu > Hello, > > We have a problem with a IP380 Checkpoint platform, the firewall is > having a 100 cpu and we think its dropping a lot of packets > most likely syslog. Does anyone know how to view these dropped packets > on the IPSO command line ( logging on most rules is not active in > dashboard) ? > - # fw ctl debug 0 - # fw ctl debug -buf 10000 (you can set the buffer up to 30.000, but be careful on a fw with high it can crash the entire system) - # fw ctl debug + drop - # fw ctl debug + drop conn ld -> if you like also to see the behavior of the ta bles) - # fw ctl kdebug -T -f > ouptfile.txt - Interupt with Ctrl-C for finishing - Disable kernel debugging again with : - # fw ctl debug -buf 0 - # fw ctl debug x M. Scanned by Check Point Total Security Gateway. ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= Scanned by Check Point Total Security Gateway. ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
