checkpoint tracker (live logs) not working

The CPs can stop logging due to server disk space filling up

Fix for this is – ssh to server and delete the old files

Navigate to $FWDIR/log and delete the old files

identify (blink) interfaces on checkpoint

ethtool -p eth4

On my dell server the normally solid orange (right side) light started blinking


On built-in interfaces I needed to run
ethtool -p eth15 10

In this case the left side solid green light went out for 10 seconds

packet capture on checkpoint firewall

Use the topology table on the checkpoint to see what interface you need to monitor

netstat -nr | grep x.x.x.x can be useful too

tcpdump -i eth5 -s0 host 192.168.1.50 -w /var/tmp/packet-capture.pcap


Copy your .pcap file off with win scp and open in wireshark

or read on CLI
tcpdump -r /var/tmp/packet-capture.pcap