---
title: "Packet Captures on Firewalls: Best Practices & Tools"
description: Learn how to perform packet captures on firewalls using tools like fw monitor and tcpdump. Enhance troubleshooting and network visibility with these techniques.
---

[Managed IT Services Blog by Rutter Networking Technologies ](https://www.rutter-net.com/blog)

# [Packet Captures on Firewalls: Best Practices & Tools](https://www.rutter-net.com/blog/news/packet-captures-on-firewalls)

 Written by [RNTblog](https://www.rutter-net.com/blog/author/rntblog) | January 4, 2012

If you have used Check Point for any period of time, you’ve probably run into the ‘fw monitor’ command which is a very useful troubleshooting tool in a variety of scenarios.

Basically, this command comes in handy when you’re troubleshooting any sort of network or firewall issue where you need a packet traced but want more visibility than tcpdump can give you about the flow of a packet through the whole firewall. The fw monitor will likely do the trick since it gives you far more visibility into each step that a packet takes through the firewall than a normal tcpdump would and it is not hindered by SecureXL being enabled.

An example would be a scenario where we look at any traffic to or from a particular host with a source port of 80.

**f****w monitor -e 'accept PROTO_tcp,dport=80 or sport=80,src=10.10.10.1 or dst=10.10.10.1;'** 

One of the benefits of the fw monitor command is that it will show you the traffic regardless of the interface it passes through, both before and after the firewall kernel as indicated by the following:

  *Before the Security Gateway processes the packet in the inbound direction (i or PREIN) *

***  After the Security Gateway processes packet in the inbound direction (I or POSTIN) *

***  Before the Security Gateway processes the packet in the outbound direction (o or PREOUT) *

***  After the Security Gateway process the packet in the outbound direction (O or POSTOUT)*

 

Of course, if you need layer 2 information (such as MAC addresses) you’ll still need to rely on tcpdump to get this information.

If you are a Check Point customer with a valid usercenter account and want more information about fw monitor, make sure you check out the following documentation:

**[SK41041](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk41045)** – the fw monitor command 

**[SK41059](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk41059)** - How to interpret fw monitor output files in Wireshark

To learn more about how we can help with your IT security needs, [schedule a free assessment.](https://www.rutter-net.com/checkpoint-it-security-consultation)

 

[View full post](https://www.rutter-net.com/blog/news/packet-captures-on-firewalls)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "RNTblog"
  },
  "dateModified" : "2025-08-09T21:48:55.197Z",
  "datePublished" : "2012-01-04T15:05:34Z",
  "headline" : "Packet Captures on Firewalls",
  "image" : {
    "@type" : "ImageObject",
    "height" : 60,
    "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
    "width" : 60
  },
  "mainEntityOfPage" : "https://www.rutter-net.com/blog/news/packet-captures-on-firewalls",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://www.rutter-net.com/hubfs/Rutter%20%20Logo-3.jpg",
      "width" : 360.0
    },
    "name" : "Managed IT Services Blog"
  }
}
```