fwm getpcap
Description
Fetches the IPS
Software Blade on a Check Point Firewall that inspects and analyzes packets and data for numerous types of risks (Intrusion Prevention System). packet capture data from the specified Security Gateway.
This command only works with IPS packet captures stored on the Security Gateway in the $FWDIR/log/captures_repository/ directory.
This command does not work with other Software Blades, such as Anti-Bot Software Blade on a Check Point Firewall that blocks botnet behavior and communication to Command and Control (C&C) centers. Acronyms: AB, ABOT. and Anti-Virus Software Blade on a Check Point Firewall that uses real-time virus signatures and anomaly-based protections from ThreatCloud to detect and block malware at the Check Point Firewall before users are affected. Acronym: AV. that store packet captures in the $FWDIR/log/blob/ directory on the Security Gateway.
|
|
Note: On a Multi-Domain Server, you must run this command in the context of the applicable Domain Management Server
|
Syntax
|
|
Parameters
|
Parameter |
Description |
||
|---|---|---|---|
|
|
Runs the command in debug mode. Use only if you troubleshoot the command itself.
For complete debug instructions, see the description of the |
||
|
|
Specifies the main IP address or Name of Security Gateway object as configured in SmartConsole |
||
|
|
Specifies the Unique ID of the packet capture file. To see the Unique ID of the packet capture file, open the applicable log file in SmartConsole > Logs & Events > Logs. |
||
|
|
Specifies the local path to save the specified packet capture file. If you do not specify the local directory explicitly, the command saves the packet capture file in the current working directory. |
Example