Command Syntax in Detail

Shows command usage

Filters packets according to the given INSPECT expression (expr)

If the -e option is not given, all packets are captured. This option is the same as running: packetmon -e "accept;"

Note: The -e option cannot be used with the -f option.

See also the -t option.

This option filters packets according to INSPECT expressions in a given file. To use pre-defined INSPECT macros, the given file must include the '#include "fwmonitor.def"' directive.

Note: The -f option cannot be used with the -e option.

Inspect.dat contents:

#include "fwmonitor.def"

tcpport(23), accept;

This option filters packets according to INSPECT expressions given in the standard input. To use pre-defined INSPECT macros, the input must include the directive:

#include "fwmonitor.def"

To stop command input and start packet inspection based on the given input, enter Ctrl-Z+<Enter> at a new line.

Note: The -f option can not be used with the -e option.

Standard input contents:

#include "fwmonitor.def"

tcpport(23), accept;

Ctrl-Z+<Enter>

The fwmonitor.def file includes all the INSPECT predefined macros you can use with the -e option. \The Fwmonitor.def file is included automatically when you use the -e option.

If you want to define new macros with the same name as those defined in fwmonitor.def, use the -t option to exclude fwmonitor.def, and include your own definition file.

Limits packet capture length to the given len bytes.
Note: len indicates number of bytes to capture starting at the IP header. Regardless of the len value, the MAC header is always captured.

If the -l option is not given, all packet data is captured

By default packetmon captures packets before and after firewall inspection. The -m option lets you to specify capture on:

• i

  Inbound packets before firewall inspection.

• I

  Inbound packets after firewall inspection.

• o

  Outbound packets before firewall inspection

• O

  Outbound packets after firewall inspection

The mask can be a combination of the above.

Not specifying the -m option is the same as running: packetmon -m iIoO

The -x option lets you print a packet's raw data. The value is an offset from the beginning of the IP header.

You can also use the len option to limit the data printed to the standard output (screen or file). If len is specified, data is printed from the offset for len number of bytes. If len is not specified, data is printed from the given offset until the end of the packet.

Note: Using the -l option can change the behavior of the -x offset option. Less data is printed to screen.

Not specifying the -x options prevents a packet's raw from being printed to screen.

The -o option saves raw packet data to a file. The file format used is the same format used by tools like snoop (RFC 1761). This file format can be examined using Wireshark, Snoop, tcpdump, or tools similar to these.

This option limit the number of packets being captured. This is useful when you need to troubleshoot a firewall handling large amounts of traffic.

• -ci

  Defines how many inbound packets to capture

• -co

  Defines how many outbound packets to capture

To avoid long interface names, this option prints the index of the interface on which the packet was received or sent. After the packet capture is stopped, a list of all interfaces (index and names) is printed.

If the option is not specified, the interface name is printed.

This option shows packets dropped by the firewall. Use this option when you need to locate a packet missing from the output.

Without this option, packetmon shows packets before they pass through the FW engine (i/o) and packets accepted by the FW engine (I/O). Packet that are dropped are not shown.

If a packet is dropped or accepted because of a rule, this option prints the name and the ID of the rule.

This option prints the time stamp for each packet.

Use this option to make sure that captured data for each packet is written immediately to the standard output (screen or file). This is useful if you want to kill a running packetmon capture process or be sure that all data is written to a file.