Check Point · Quantum R81.20 / R82 · Lesson 11 of 17

fw monitor: the positions people skip

tcpdump on eth1 shows the packet. fw monitor “shows nothing.” You filtered the post-NAT IP at the pre-inbound point — or you never asked for -m i I o O. This lesson is the four (plus VPN) letters, and why position is the whole tool.

Updated 2026-08-18·22 min read·L2 primary·Quiz at end

After this page you can

Draw i → I → o → O on inbound then outbound.
Know default capture is around the FireWall VM, not every chain.
Use -m masks and -F simple filters (R80.20+ includes accelerated).
Explain why only i then silence often means a drop in the VM.
Not run -p all in production without a reason (CPU).

The ticket

tcpdump sees SYN on eth1. fw monitor -e "host(10.20.30.41), accept;" is empty. NAT already changed dest to 10.20.30.50 at the point you are watching — or SecureXL and your old -e filter ignored accelerated packets.

Quick interview answer

fw monitor captures at FireWall chain points: i pre-inbound, I post-inbound, o pre-outbound, O post-outbound. VPN adds e/E. Default is the VM module. From R80.20 it can show SecureXL traffic; -e INSPECT filters do not apply to accelerated packets — use -F.

Lab data · dummy only

SMS sms-lab 10.10.10.5 · cluster VIP 10.10.10.1 (cp-gw-01 10.10.10.2 / cp-gw-02 10.10.10.3) · external 203.0.113.25 · internal LAN 10.20.30.0/24 · HR PC 10.20.30.80 TECHCLICK\priya.hr · HR app 10.20.30.41 hr.techclick-lab.in. Not a live customer.

The letters

Official R81 CLI table (packet direction, not “the connection’s idea of inbound”):

Point	Meaning	Example
i	Pre-inbound (before inbound FW VM)	`eth1:i`
I	Post-inbound (after inbound FW VM)	`eth1:I`
o	Pre-outbound	`eth0:o`
O	Post-outbound	`eth0:O`
e / E	Pre/post outbound VPN encrypt	Community encrypt

Client → server through the box: eth1:i → VM → eth1:I … then eth0:o → VM → eth0:O. If you only see i, the VM likely dropped before post-inbound.

One packet, four stamps

NAT often changes addresses between i and O. Filter the IP that exists at that point.

tcpdump vs fw monitor

Need	Tool
Wire / NIC, ARP	tcpdump
Did it enter/leave the VM? NAT in path?	fw monitor
Every chain module	`-p all` (CPU — lab only unless SK says)

How you capture

Side A — pick IPs that exist at the point
Pre-inbound dest may still be 203.0.113.40. Post-NAT dest is 10.20.30.50.
Side B — command
Prefer -F simple filter + -m i,I,o,O + -ci count so you can stop.
Side C — read letters
i only → dropped in inbound VM. i I o no O → outbound problem. All four → policy path ok, look past the box.

R81-style · dummy

# Simple filter (accelerated + non-accelerated) — R81 CLI
fw monitor -m i,I,o,O -ci 20 -co 20 \
  -F "10.20.30.80,0,10.20.30.41,443,6"

# Only one fw monitor at a time. Stop: Ctrl+C or fw monitor -U
# -e INSPECT filters do NOT apply to accelerated traffic (official warning).

fw ctl chain   # see VM vs SecureXL modules

Four monitor failures

1 · Wrong IP at that letter

You grepped 10.20.30.50 at i before dest NAT. Looks like “nothing.”

2 · -e on accelerated traffic

Official: INSPECT -e filters do not apply to accelerated packets. Use -F.

3 · Forgot -m, expected four letters

Default is VM-centric. Still should see i/I/o/O around the VM if traffic hits it. If SecureXL fast-path skips what you think, read lesson 12.

4 · -p all on a busy box

Official warning: very high CPU. Lab or a tight -ci.

How to prove it

Close the capture only when

1) You wrote which letters appeared. 2) You matched IPs to NAT point. 3) You stopped the monitor. 4) Next action is policy, NAT, TP, or SecureXL — not a second random tcpdump.

Traps

What you see	Meaning	Next
tcpdump yes, monitor no	Accelerated / wrong filter / not in VM	-F, SecureXL stat
i then silence	Drop in inbound VM	Logs / zdebug
i I o O	Left the box	Routing / peer

Check Point class series: Architecture · Gaia first day · SIC reset · Objects + first match · Policy layers · Hide vs Static NAT · Identity Awareness · HTTPS Inspection · Threat Prevention · Find the drop · fw monitor · SecureXL · ClusterXL · VPN Community · Policy install lock · vs PA vs Forti · CCSA / CCSE interview

Sources

R81 CLI — fw monitor (masks, -F, -e warning, i/I/o/O/e/E, one instance, -p all CPU).
sk30583 — What is FW Monitor?

Related: Check Point evidence desk · session factory · next lesson in the series above.