SecureXL Debug Modules and Debug Flags

Module "default"

Flag	Description
`acct`	Connection accounting information
`ant`	Anticipated connections
`conf`	Configuration of the SecureXL (for example, interfaces)
`conn`	Processing of connections
`conn_app`	Processing of connections
`corr`	Correction layer
`cpdrv`	Currently not in use
`del`	Deletion of connections
`drv`	Driver information
`htab`	Hash table
`infra_ids`	Allocating IDs for a given range in Identity Awareness Check Point Software Blade on a Security Gateway that enforces network access and audits data based on network location, the identity of the user, and the identity of the computer. Acronym: IDA.
`init`	Initialization
`ioctl`	Changes in the configuration, which were initiated from the user space
`iter`	Connection table iterator
`kdrv`	Driver information
`lock`	Lock initializing and finalizing
`nat`	Processing of NAT connections
`offload`	Offloading of connections from the Firewall to the SecureXL
`queue`	Connections queue
`relations`	Related connections (such as FTP data connections)
`rngs`	Handling of SecureXL ranges
`rngs_print`	Printing of SecureXL ranges
`routing`	Handling of SecureXL routing
`stat`	Handling of SecureXL statistics
`svm`	Registering templates or connections for System Counters in Security Gateway Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. object in SmartConsole Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on.
`tag`	Tags that were added to the packets by the SecureXL before forwarding Process of transferring of an incoming traffic from one Cluster Member to another Cluster Member for processing. There are two types of forwarding the incoming traffic between Cluster Members - Packet forwarding and Chain forwarding. For more information, see "Forwarding Layer in Cluster" and "ARP Forwarding". them to the Firewall
`tcp_sv`	Verification of sequence in TCP packets
`update`	Updates of connections
`util`	Utilization

Module "pkt" (Packet)

Flag	Description
`acct`	Connection accounting information
`bhm`	BHM Statistics for each CPU
`caf`	Mirror and Decrypt The Mirror and Decrypt feature on a Security Gateway or Cluster (in versions R80.40 and higher) that performs these actions: (1) Mirror only of all traffic - Clones all traffic (including HTTPS without decryption) that passes through, and sends it out of the designated physical interface. (2) Mirror and Decrypt of HTTPS traffic - Clones all HTTPS traffic that passes through, decrypts it, and sends it in clear-text out of the designated physical interface. Acronym: M&D. feature - Mirror only of all traffic
`corr`	Correction layer
`cpls`	ClusterXL Cluster of Check Point Security Gateways that work together in a redundant configuration. The ClusterXL both handles the traffic and performs State Synchronization. These Check Point Security Gateways are installed on Gaia OS: (1) ClusterXL supports up to 5 Cluster Members, (2) VRRP Cluster supports up to 2 Cluster Members, (3) VSX VSLS cluster supports up to 13 Cluster Members. Note: In ClusterXL Load Sharing mode, configuring more than 4 Cluster Members significantly decreases the cluster performance due to amount of Delta Sync traffic. Load Sharing A redundant cluster mode, where all Cluster Members process all incoming traffic in parallel. For more information, see "Load Sharing Multicast Mode" and "Load Sharing Unicast Mode". Synonyms: Active/Active, Load Balancing mode. Acronym: LS.
`deliver`	Packet delivery
`drop`	Packets dropped by SecureXL
`f2f`	Reason for forwarding a packet to the Firewall
`frag`	Processing of fragments
`geneve`	Processing of Generic Network Virtualization Encapsulation (Geneve) packets in GRE and VxLAN interfaces
`nat`	Processing of NAT connections
`notif`	Notifications sent to the Firewall
`pkt`	Processing of packets
`pxl`	PXL (PacketXL) handling - API between the SecureXL and PSL Passive Streaming Library. Packets may arrive at Security Gateway out of order, or may be legitimate retransmissions of packets that have not yet received an acknowledgment. In some cases, a retransmission may also be a deliberate attempt to evade IPS detection by sending the malicious payload in the retransmission. Security Gateway ensures that only valid packets are allowed to proceed to destinations. It does this with the Passive Streaming Library (PSL) technology. (1) The PSL is an infrastructure layer, which provides stream reassembly for TCP connections. (2) The Security Gateway makes sure that TCP data seen by the destination system is the same as seen by code above PSL. (3) The PSL handles packet reordering, congestion, and is responsible for various security aspects of the TCP layer, such as handling payload overlaps, some DoS attacks, and others. (4) The PSL is capable of receiving packets from the Firewall chain and from the SecureXL. (5) The PSL serves as a middleman between the various security applications and the network packets. It provides the applications with a coherent stream of data to work with, free of various network problems or attacks. (6) The PSL infrastructure is wrapped with well-defined APIs called the Unified Streaming APIs, which are used by the applications to register and access streamed data. (Packet Streaming Layer), which is a TCP Streaming engine that parses TCP streams
`qos`	QoS Check Point Software Blade on a Security Gateway that provides policy-based traffic bandwidth management to prioritize business-critical traffic and guarantee bandwidth and control latency. acceleration
`routing`	Handling of SecureXL routing
`sctp`	Handling of Stream Control Transmission Protocol (SCTP) packets
`spoof`	Handling of SecureXL Anti-Spoofing
`sv`	Validation of sequence in TCP packets
`tcp_state`	Validation of TCP state in TCP packets
`tcp_state_pkt`	Validation of TCP packets
`user`	Details of a packet
`vlan`	Handling of VLAN tags
`wrp`	Handling of WRP interfaces in VSX Virtual System Extension. Check Point virtual networking solution, hosted on a computer or cluster with virtual abstractions of Check Point Security Gateways and other network devices. These Virtual Devices provide the same functionality as their physical counterparts.

Module "db" (Database)

Flag	Description
`ant`	Anticipated connections
`del`	Deleting of data from the SecureXL database
`get`	Retrieving of data from the SecureXL database
`init`	Initializing and finalizing of SecureXL database
`nmr`	"No Match Ranges" templates, which allow SecureXL Accept Templates for rules that contain Dynamic objects or Domain objects (or for rules located below such rules)
`nmt`	"No Match Time" templates, which allow SecureXL Accept Templates for rules that contain Time objects (or for rules located below such rules)
`profile`	Operations on profile table
`save`	Saving of data to the SecureXL database
`tmo`	Handling of timeouts for SecureXL database entries
`tmpl`	Handling of SecureXL templates database
`warning`	General failures to process a packet

Module "api" (Application Programmable Interface)

Flag	Description
`acct`	Connection accounting information
`add`	Adding of connections
`add_sa`	Offloading of VPN SA to SecureXL
`conf`	Configuration of the SecureXL (for example, interfaces)
`del`	Deletion of connections
`del_all_sas`	Deletion of all VPN SAs from SecureXL
`del_all_tmpl`	Deletion of the SecureXL Templates
`del_sa`	Deletion of VPN SA from SecureXL
`get_features`	Getting features buffer (in SecureXL initialization)
`get_stat`	Retrieving of SecureXL statistics
`get_state`	Getting the connection state from SecureXL
`get_tab`	Some extra printouts when processing SecureXL tables
`gtp`	Processing of GPRS Tunnelling Protocol (GTP) tunnel connections
`infra`	SecureXL infrastructure
`init`	Enabling and disabling of SecureXL
`long_ver`	Prints additional verbose information about connections
`misc`	Prints additional information about SecureXL internals
`notif`	Notifications sent to the Firewall
`pxl`	PXL (PacketXL) handling - API between the SecureXL and PSL (Packet Streaming Layer), which is a TCP Streaming engine that parses TCP streams
`qos`	QoS acceleration
`reset_stat`	Prints statistics IDs that are reset
`stat`	Handling of SecureXL statistics
`sv`	Validation of sequence in TCP packets
`tag`	Tags that were added to the packets by the SecureXL before forwarding them to the Firewall
`tmpl`	Handling of SecureXL Templates
`tmpl_info`	Information about SecureXL Templates
`upd_conf`	Update of SecureXL in ClusterXL Load Sharing
`upd_if_inf`	Prints some text that shows if SecureXL updated information about interfaces
`upd_link_sel`	Updates of VPN Link Selection The packet selection mechanism is one of the central and most important components in the ClusterXL product and State Synchronization infrastructure for 3rd-party clustering solutions. Its main purpose is to decide (to select) correctly what has to be done to the incoming and outgoing traffic on the Cluster Member. (1) In ClusterXL, the packet is selected by Cluster Member(s) depending on the cluster mode: In HA modes - by Active member; In LS Unicast mode - by Pivot member; In LS Multicast mode - by all members. Then the Cluster Member applies the Decision Function (and the Cluster Correction Layer). (2) In 3rd-party / OPSEC cluster, the 3rd-party software selects the packet, and Check Point software just inspects it (and performs State Synchronization).
`update`	Updates of connections
`vpn`	Processing of VPN connection

Module "adp" (NVIDIA ConnectX 100G Cards)

Flag	Description
`ac_print`	Prints additional information
`bond`	Information about Bond interfaces
`bpl`	Information about packet processing in the backplane
`bplinf`	Information about packet processing in the backplane
`cpfifo`	Currently is not used
`drop`	Information about packet drops in the backplane
`eth`	Information about ports from the NVIDIA ConnectX 100G Card's point of view
`filter`	Information about packet processing in the network interface
`heth`	Information about ports from the Host Security Appliance's point of view
`hw_expn`	Information about packet processing in the NVIDIA ConnectX 100G Card
`hw_offload`	Offloading of connections from the Host Security Appliance to the SecureXL
`if`	Information about interfaces
`inf`	Information about slots and ports
`ipsctl`	Information about slots in the Host Security Appliance
`mbeinf`	Information about packet processing in the backplane
`mbs`	Information about packet processing in the backplane
`mcast`	Handling of multicast traffic
`nh`	Handling of next hop routing
`packet`	Information about packet processing in the NVIDIA ConnectX 100G Card
`qcomm`	Information about communication queues
`qconf`	Information about packets in the communication queues
`rt`	Handling of general routing
`rte_api`	Detailed information about packet processing in the NVIDIA ConnectX 100G Card
`wrp`	Handling of WRP interfaces in VSX
`xmode`	Events in the known neighbors database

Module "infras" (Identity Awareness - Identities Infrastructure)

Flag	Description
`pm`	Pattern Matcher
`reorder`	Reordering of packets in queue

Module "nac" (Identity Awareness - Network Access Control)

Flag	Description
`db`	Updating, adding, deleting of identities
`db_get`	Updating, fetching, searching of identities
`idnt`	Identity Tags
`ioctl`	Changes in the configuration, which were initiated from the user space
`nac`	Network Access Control
`offload`	Offloading of connections from the Firewall to the SecureXL
`pkt`	Forwarding of connections to Firewall (when identity is not found or revoked, or NAC Network Access Control. This is an approach to computer security that attempts to unify endpoint security technology (such as Anti-Virus, Intrusion Prevention, and Vulnerability Assessment), user or system authentication and network security enforcement. Check Point's Network Access Control solution is called Identity Awareness Software Blade. packet tagging verification failed)
`pkt_ex`	NAC packet-tagging verification
`signature`	Signing of packets

Module "vpn" (VPN)

Flag	Description
`linksel`	VPN Link Selection
`ls`	Forwarding of packets between Cluster Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing. Members in a ClusterXL Load Sharing mode
`routing`	VPN Encryption routing information
`vpn`	Processing of VPN connections
`vpnpkt`	Processing of VPN packets

Module "cpaq" (Internal Asynchronous Queue)

Flag	Description
`broadcast`	Processing of broadcast packets
`cbuf`	Information about queue buffers
`client`	Information about queue clients
`error`	General errors
`exp`	Information about expiration of queue items
`init`	Initializing of queue
`opreg`	Currently not in use
`server`	Information about queue servers
`transport`	Information about sending messages in queue
`transport_utils`	Additional information about sending messages in queue

Module "dos" (Denial of Service Defender)

Flag	Description
`cache`	Currently not in use
`detailed-cfg`	Detailed information about DoS Rate Limiting configuration. Important - This debug flag is not suitable for large traffic volumes because it prints a large number of messages. This causes high load on the CPU.
`detailed-pkt`	Detailed information about DoS Rate Limiting packet flow. Important - This debug flag is not suitable for large traffic volumes because it prints a large number of messages. This causes high load on the CPU.
`drop`	Dropped packets
`fw1-cfg`	Information about DoS Rate Limiting configuration in the Firewall kernel module
`fw1-pkt`	Information about DoS Rate Limiting packet flow in the Firewall kernel module
`sim-cfg`	Information about DoS Rate Limiting configuration in the SecureXL kernel module
`sim-pkt`	Information about DoS Rate Limiting packet flow in the SecureXL kernel module

Module "synatk" (Accelerated SYN Defender)

Flag	Description
`conf`	Receiving and updating of Accelerated SYN Defender module's configuration
`conn`	Handling of TCP connections
`init`	Initializing of the Accelerated SYN Defender module
`log`	Prints time of the last sent monitor log and interval between the monitor logs
`msg`	Information about internal messages in the Accelerated SYN Defender module
`pkt`	Handling of TCP packets
`proxy`	Currently not in use
`state`	Information about states of the Accelerated SYN Defender module

Module "tmpl" (Drop Templates)

Flag	Description
`dtmpl_get`	Getting of Drop Templates
`dtmpl_notif`	Notifications about Drop Templates
`tmpl`	Information about Drop Templates

Module "gtp" (GPRS Tunnelling Protocol (GTP))

Flag	Description
`api`	Information about GTP tunnels in kernel tables
`drop`	Drops of GTP packets
`general`	General information about APN and kernel tables
`notif`	Information about notification messages
`pkt`	Processing of GTP packets
`policy`	APN information
`tables`	Operations in kernel tables

Module "usdisp" (User Space Dispatcher)

Flag	Description
`api`	Currently not in use
`cachetab`	Currently not in use
`clb`	Currently not in use
`conn`	Processing of connections
`counter`	Currently not in use
`dumbo`	Currently not in use
`error`	General errors
`event`	Currently not in use
`fwstats`	Currently not in use
`ioctl`	IOCTL control messages (communication between kernel and user space processes)
`lock`	Currently not in use
`msg`	Currently not in use
`packet`	Processing of packets
`packet_err`	Processing of packets
`prio`	Currently not in use
`queue`	Currently not in use
`quota`	Currently not in use
`route`	Currently not in use
`state`	Currently not in use
`temp_conns`	Shows the selected CoreXL Performance-enhancing technology for Security Gateways on multi-core processing platforms. Multiple Check Point Firewall instances are running in parallel on multiple CPU cores. Firewall instance
`uid`	Currently not in use
`vpn`	Currently not in use

Module "dpdk_lib" (Data Plane Development Kit (DPDK) - Library)

Reserved for future use.

Module "dpdk_pmd" (Data Plane Development Kit (DPDK) - Poll Mode Drivers)

Reserved for future use.

Module "dpdk_other" (Data Plane Development Kit (DPDK) - Other)

Reserved for future use.