# fw monitor: the positions people skip

Source: https://ai.techclick.in/blog_checkpoint_fw_monitor_positions
Markdown: https://ai.techclick.in/blog_checkpoint_fw_monitor_positions.md
Publisher: Techclick Infosec Pvt Ltd

fw monitor i I o O (and e E) are inspection points, not nic tap. NAT and drops change which letters you see. Official R81 CLI.

## The ticket

 tcpdump sees SYN on eth1.  fw monitor -e "host(10.20.30.41), accept;"  is empty. NAT already changed dest to 10.20.30.50 at the point you are watching — or SecureXL and your old  -e  filter ignored accelerated packets.

  Quick interview answer

 fw monitor captures at FireWall chain points:  i  pre-inbound,  I  post-inbound,  o  pre-outbound,  O  post-outbound. VPN adds  e/E . Default is the VM module. From R80.20 it can show SecureXL traffic;  -e  INSPECT filters do  not  apply to accelerated packets — use  -F .

  Lab data · dummy only
 SMS  sms-lab   10.10.10.5  · cluster VIP  10.10.10.1  ( cp-gw-01   10.10.10.2  /  cp-gw-02   10.10.10.3 ) · external  203.0.113.25  · internal LAN  10.20.30.0/24  · HR PC  10.20.30.80   TECHCLICK\priya.hr  · HR app  10.20.30.41   hr.techclick-lab.in . Not a live customer.

## The letters

 Official R81 CLI table (packet direction, not “the connection’s idea of inbound”):

   Point  Meaning  Example

  i  Pre-inbound (before inbound FW VM)   eth1:i
  I  Post-inbound (after inbound FW VM)   eth1:I
  o  Pre-outbound   eth0:o
  O  Post-outbound   eth0:O
  e / E  Pre/post outbound VPN encrypt  Community encrypt

 Client → server through the box:  eth1:i  → VM →  eth1:I  … then  eth0:o  → VM →  eth0:O . If you only see  i , the VM likely dropped before post-inbound.

   One packet, four stamps

       i I o O
        i
        FW VM in
        I
        o
        FW VM out
        O

   NAT often changes addresses between i and O. Filter the IP that exists at that point.

## tcpdump vs fw monitor

   Need  Tool

  Wire / NIC, ARP  tcpdump
  Did it enter/leave the VM? NAT in path?  fw monitor
  Every chain module   -p all  (CPU — lab only unless SK says)

## How you capture

- #### Side A — pick IPs that exist at the point Pre-inbound dest may still be 203.0.113.40. Post-NAT dest is 10.20.30.50.

- #### Side B — command Prefer -F simple filter + -m i,I,o,O + -ci count so you can stop.

- #### Side C — read letters i only → dropped in inbound VM. i I o no O → outbound problem. All four → policy path ok, look past the box.

  R81-style · dummy  # Simple filter (accelerated + non-accelerated) — R81 CLI
fw monitor -m i,I,o,O -ci 20 -co 20 \
  -F "10.20.30.80,0,10.20.30.41,443,6"

# Only one fw monitor at a time. Stop: Ctrl+C or fw monitor -U
# -e INSPECT filters do NOT apply to accelerated traffic (official warning).

fw ctl chain   # see VM vs SecureXL modules

## Four monitor failures

### 1 · Wrong IP at that letter

 You grepped 10.20.30.50 at  i  before dest NAT. Looks like “nothing.”

### 2 · -e on accelerated traffic

 Official: INSPECT  -e  filters do not apply to accelerated packets. Use  -F .

### 3 · Forgot -m, expected four letters

 Default is VM-centric. Still should see i/I/o/O around the VM if traffic hits it. If SecureXL fast-path skips what you think, read lesson 12.

### 4 · -p all on a busy box

 Official warning: very high CPU. Lab or a tight  -ci .

## How to prove it

  Close the capture only when

 1) You wrote which letters appeared. 2) You matched IPs to NAT point. 3) You stopped the monitor. 4) Next action is policy, NAT, TP, or SecureXL — not a second random tcpdump.

## Traps

   What you see  Meaning  Next

  tcpdump yes, monitor no  Accelerated / wrong filter / not in VM  -F, SecureXL stat
  i then silence  Drop in inbound VM  Logs / zdebug
  i I o O  Left the box  Routing / peer

## Knowledge check

   Judgment items. One best answer. Reasons send you back to the matching section.

       Q1
       Letter i means?

           Post-outbound
           Pre-inbound, before inbound FW VM
           VPN only
           QoS only

       Correct:  b . R81 table.

       Q2
       You see only i for a SYN. Likely?

           Dropped in the inbound VM
           Cluster is fine and policy accepted
           Need more Hide NAT
           SIC reset required

       Correct:  a . Concept.

       Q3
       Why can -e miss traffic from R80.20?

           INSPECT filters do not apply to accelerated traffic
           -e is removed
           It only logs SIC
           It requires Windows

       Correct:  a . Official warning.

       Q4
       Better filter for accelerated + slow path?

           -F "src,sport,dst,dport,proto"
           ifconfig
           cpconfig
           publish

       Correct:  a . R81 -F parameter.

       Q5
       How many fw monitor instances can run?

           Only one
           One per CPU
           Unlimited
           Two per VSX

       Correct:  a . Official note.

       Q6
       -p all is dangerous because…

           Very high CPU
           It deletes policy
           It resets SIC
           It disables logs

       Correct:  a . Official warning.

       Check answers
       Reset

  Check Point class series:   Architecture  ·  Gaia first day  ·  SIC reset  ·  Objects + first match  ·  Policy layers  ·  Hide vs Static NAT  ·  Identity Awareness  ·  HTTPS Inspection  ·  Threat Prevention  ·  Find the drop  ·  fw monitor  ·  SecureXL  ·  ClusterXL  ·  VPN Community  ·  Policy install lock  ·  vs PA vs Forti  ·  CCSA / CCSE interview

## Sources

- R81 CLI — fw monitor (masks, -F, -e warning, i/I/o/O/e/E, one instance, -p all CPU).
- sk30583 — What is FW Monitor?

 Related:  Check Point evidence desk  ·  session factory  · next lesson in the series above.

---
Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees.
Browse all lessons: https://ai.techclick.in/blogs
AI index: https://ai.techclick.in/llms.txt