fw ctl multik print_heavy

Description

Shows the table with Heavy Connections (that consume the most CPU resources) in the CoreXL Performance-enhancing technology for Security Gateways on multi-core processing platforms. Multiple Check Point Firewall instances are running in parallel on multiple CPU cores. Dynamic Dispatcher.

For more information about the CoreXL Dynamic Dispatcher, see sk105261.

CoreXL suspects that a connection is "heavy" if it meets these conditions:

Security Gateway Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. detected the suspected connection during the last 24 hours
The suspected connection lasts more than 10 seconds
CoreXL Firewall instance that processes this connection causes a CPU load of over 60%
The suspected connection utilizes more than 50% of the total work the applicable CoreXL Firewall instance does

The output table shows this information about the Heavy Connections:

Source IP address
Source Port
Destination IP address
Destination Port
Protocol Number
CoreXL Firewall instance ID that processes this connection
CoreXL Firewall instance load on the CPU
Connection's relative load on the CoreXL Firewall instance

Notes:

This command shows the suspected heavy connections even if they are already closed.
In the CPView utility, go to CPU > Top-Connections > InstancesX-Y > InstanceZ. Refer to the Top Connections section.

Syntax

fw [-d] ctl multik print_heavy_conn

Parameters

Parameter

Description

-d

Runs the command in debug mode.

Use only if you troubleshoot the command itself.

Best Practice - If you use this parameter, then redirect the output to a file, or use the script command to save the entire CLI session.

Example

[Expert@MyGW:0]# fw ctl multik print_heavy_conn
Source: 192.168.20.31; SPort: 51006; Dest: 172.30.40.55; DPort: 80; IPP: 6; Instance 1; Instance Load 61%; Connection instance load 100%
Source: 192.168.20.31; SPort: 50994; Dest: 172.30.40.55; DPort: 80; IPP: 6; Instance 1; Instance Load 61%; Connection instance load 100%
Source: 192.168.20.31; SPort: 50992; Dest: 172.30.40.55; DPort: 80; IPP: 6; Instance 1; Instance Load 61%; Connection instance load 100%
[Expert@MyGW:0]#