www.schaareman.net

Open a command prompt and go to the following folder:
C:\Program Files\CheckPoint\SecuRemote\bin

Launch the following command: "srfw monitor -o c:\capture.cap"
This will start a complete capture. Output will be saved in c:\capture.cap

Om op een Nortel switch een monitor port aan te maken geef je het volgende commando:

"port-mirroring mode XrxOrXtx monitor-port 1/41 mirror-port-X 1/78"

Waar de mirror-port-x de poort is waar je het verkeer van wilt zien, en monitor-port de poort waar je je laptop met sniffer aan kunt hangen.

This command allows you to monitor network traffic going through the FireWall-1 Kernel Module. This is sort of like tcpdump except that it shows you what things look like from the perspective of various parts of FireWall-1 and can be used to monitor all interfaces simultaneously.

There are four "inspection" points as packets pass through FireWall-1. We choose where we want to "see" packets with the -m option:

( i ) = Before FireWall-1 processes the packet in the inbound direction.

( I ) = After FireWall-1 processes packet in the inbound direction.

This is a quick reference guide to the most popular and widely used Nokia Clish Commands:

---setting default gateway

set static-route default nexthop gateway address 192.168.29.2 priority 1 on

---adding static routes

set static-route 172.23.124.150/32 nexthop gateway address 192.168.29.50 on

---Add proxy arp

add arpproxy address 192.168.29.56 macaddress 0:a0:8e:7d:13:d0add arpproxy address 192.168.29.57 macaddress 0:a0:8e:7d:13:d0

---Add an interface

set interface eth1 speed 100M duplex full active onadd interface eth1c0 address 192.168.29.54/24 enable

What happens if you use the debug ip packet command on a router? Don't try it! This command can actually bring an entire production router down.

However, when used properly, this command can be a very helpful tool. For example, you can use debug ip packet with an ACL. And, you can even ask for details.

So, let's say you want to view only traffic from host 1.1.1.1 to host 2.2.2.2 that was using port 80. Being very careful, you could see it using debug ip packet and an ACL. Here's an example: