cpmonitor

Description

The CPMonitor tool analyzes traffic captured by the TCPdump, the Check Point FW Monitor (see fw monitor).

The CPMonitor tool parses the input traffic capture file and extracts valuable information from it, including:

  • Overall traffic statistics (pps, cps, concurrent, throughput)

  • Top connections, top servers and top services

  • Detailed connections, servers and services (with packet size distribution)

  • Per second analysis

When analyzing the captured traffic, the CPMonitor tool can run in one of these modes: Complete or Navigate, producing different insights.

For more information, see sk132193.

Important:

  • You must run this command in the Expert mode.

  • On Scalable Platforms (Maestro and Chassis), you must connect to the applicable Security Group.

Syntax

cpmonitor [<Parameters>] /<Path To>/<Traffic Capture File>

cpmonitor --version

Parameters

You can specify several parameters.

Parameter

Description

/<Path To>/<Traffic Capture File>

Specifies the path to the traffic capture file to be analyzed.

-c <Size of Connections Table>

Specifies the size of the Connections Table - an integer number of entries that the Connections Table can hold.

Default = 10,000,000

Maximum = 200,000,000

-g /<Path To>/<Graph File>

Saves a timeline graph in the specified file (automatically adds the CSV extension):

/<Path To>/<Graph File>.csv

-n /<Path To>/<Traffic Capture File>

Navigates through the traffic capture file.

Creates a report for the first second of the traffic capture file, allows navigation across the file, and increases the window size to cover more than one second.

This mode allows better understanding of traffic bursts and peaks, which may have occurred during the capture.

Note - Press "h" to see available options.

-o /<Path To>/<Output File>

Saves the report in the specified file (automatically adds the TXT extension):

/<Path To>/<Output File>.txt

-q

Quiet mode, no output on stdout.

Only saves the information in the output file(s).

-s {p | t}

Configures the sorting method for top entities:

  • p - Sort by packets (default)

  • t - Sort by throughput

-t <Name>

Saves the entire tables in these files:

/<Path To>/<Name>_<Table Name>.csv

This parameter creates detailed CSV files that contain all the connections, servers, and services.

This gives you a complete picture of the entire traffic (not just the top connections).

-v

Verbose mode.

--version

Shows the "cpmonitor" version number.