Wireshark configuration for Check Point fw monitor
Here is how to set-up correctly wireshark in order to read fw monitor output friendly:
- ctrl+shift+p
- Protocols / Ethernet / Attempt to interpret as Firewall-1 monitor file
- Protocols / FW-1 / Monitor file includes UUID and Interface list includes chain position
- User Interface / Columns / Add : fw-1 chain|FW-1 monitor if/direction
- Apply preferences
- View / Coloring rules / New
- preIn / fw1.direction==i
- postIn / fw1.direction==I
- preOut / fw1.direction==o
- postOut / fw1.direction==O
Good luck!