Traffic Capture on MHO-200 - m_tcpdump

Use this command in either Gaia Clish or the Expert mode to capture traffic on Orchestrator ports.

Note:

The m_tcpdump command is a Check Point wrapper for the standard tcpdump tool.

  1. Connect to the command line on the Orchestrator.
  2. Log in to Gaia Clish or the Expert mode.
  3. Get the exact Port ID - either in Gaia Portal or in Gaia Clish.
  4. Capture traffic on the relevant Port: 
    m_tcpdump -i <Port ID> <options>

    For the list of options, refer to https://www.tcpdump.org/manpages/tcpdump.1.html.

  5. If you saved the captured traffic in a file, then copy it from the Orchestrator to your workstation and analyze it (for example, in Wireshark).