> Source: [sk141412](https://support.checkpoint.com/results/sk/sk141412) # sk141412 - cppcap - Check Point Traffic Capture Tool | Property | Value | |----------|-------| | Solution ID | sk141412 | | Date Created | 2018-11-29 | | Last Modified | 2026-06-02 | | Technical Level | General | | Products | Security Gateway, Scalable Platforms | | Versions | R82, R81.20, R81.10 (EOS), R81 (EOS), R82, R81.20, R81.10 (EOS), R81 (EOS) | | OS | Gaia | ## Solution **Table of Contents:** * Overview * Availability * Installation Instructions (for R80.30 and lower) * CLI Syntax * Usage Examples * Known Limitations ### Overview {#TOC01} Check Point created a traffic capture tool for Gaia OS - **CPPCAP** . This is a traffic capture tool that provides the most relevant outputs and is similar to the Linux tool TCPdump. This tool was created to resolve various issues in the Linux tool TCPdump that significantly increased CPU load on Security Gateways. **Notes:** * CPPCAP is supported only on Gaia OS in the 64-bit mode (default in R80.40 and higher). * CPPCAP also captures traffic that is accelerated in SecureXL. ### Availability {#TOC02} |-----------------------|------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Version | CPUSE Online Identifier | Offline Download | | **R80.40 and higher** | **The tool is built-in.** | N / A | | R80.30 kernel 3.10 | `Check_point_R80.30_3.10_cp_pcap_sk141412.rpm` | [![](https://sc1.checkpoint.com/sc/images/download-m.png "Check_point_R80.30_3.10_cp_pcap_sk141412.rpm")](https://support.checkpoint.com/results/download/102770) (RPM) | | R80.30SP kernel 3.10 | `Check_point_R80.30SP_cp_pcap_sk141412.rpm` | [![](https://sc1.checkpoint.com/sc/images/download-m.png "Check_point_R80.30SP_cp_pcap_sk141412.rpm")](https://support.checkpoint.com/results/download/110601) (RPM) | | R80.30 kernel 2.6 | `Check_point_R80.30_cp_pcap_sk141412.rpm` | [![](https://sc1.checkpoint.com/sc/images/download-m.png "Check_point_R80.30_cp_pcap_sk141412.rpm")](https://support.checkpoint.com/results/download/90389) (RPM) | | R80.20SP | `Check_point_R80.20SP_cp_pcap_sk141412.rpm` | [![](https://sc1.checkpoint.com/sc/images/download-m.png "Check_point_R80.20SP_cp_pcap_sk141412.rpm")](https://support.checkpoint.com/results/download/103697) (RPM) | | R80.20 | `Check_point_R80.20_cp_pcap_sk141412.rpm` | [![](https://sc1.checkpoint.com/sc/images/download-m.png "Check_point_R80.20_cp_pcap_sk141412.rpm")](https://support.checkpoint.com/results/download/76766) (RPM) | | R80.10 | `Check_point_R80.10_cp_pcap_sk141412.rpm` | [![](https://sc1.checkpoint.com/sc/images/download-m.png "Check_point_R80.10_cp_pcap_sk141412.rpm")](https://support.checkpoint.com/results/download/76765) (RPM) | | R77.30 | `Check_point_R77.30_cp_pcap_sk141412.rpm` | [![](https://sc1.checkpoint.com/sc/images/download-m.png "Check_point_R77.30_cp_pcap_sk141412.rpm")](https://support.checkpoint.com/results/download/76764) (RPM) | | R76SP.50 | `Check_point_R76SP.50_cp_pcap_sk141412.rpm` | [![](https://sc1.checkpoint.com/sc/images/download-m.png "Check_point_R76SP.50_cp_pcap_sk141412.rpm")](https://support.checkpoint.com/results/download/76763) (RPM) | ### Installation Instructions (for R80.30 and lower) {#TOC03}
Show / Hide the Installation Instructions for CPUSE Online Identifier (for R80.30 and lower) **Note** - Reboot or restart of Check Point services are not required. See the [CPUSE Administration Guide](https://sc1.checkpoint.com/documents/CPUSE/Default.htm#cshid=ID004).
Show / Hide the Installation and Uninstall Instructions for Offline RPM Package (for R80.30 and lower) **Note** - Reboot or restart of Check Point services are not required. |----------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Platform | Installation Instructions | Uninstall Instructions | | Security Gateways, ClusterXL, VRRP Cluster, VSX Gateway, VSX Cluster | 1. Download the required offline RPM package. 2. Transfer the RPM package to the Security Gateway / **each** Cluster Member to some directory (for example, `/var/log/`). 3. Connect to the command line on the Security Gateway / **each** Cluster Member. 4. Log in to the Expert mode. 5. Install the RPM: `rpm -ivh --force --nodeps //` 6. Start the CPPCAP service: `/etc/init.d/start_cppcap start` | 1. Connect to the command line on the Security Gateway / **each** Cluster Member. 2. Log in to the Expert mode. 3. Stop the CPPCAP service: `/etc/init.d/start_cppcap stop` 4. Uninstall the RPM: `rpm -e cp_pcap` | | Scalable Platforms | 1. Download the required offline RPM package. 2. Transfer the RPM package to the Security Group to some directory (for example, `/var/log/`). 3. Connect to the command line on the Security Group. 4. Log in to the Expert mode. 5. Copy the RPM to all Security Group Members: `asg_cp2blades //` 6. Install the RPM on all Security Group Members: `g_all rpm -ivh --force --nodeps //` 7. Start the CPPCAP service on all Security Group Members: `g_all /etc/init.d/start_cppcap start` | 1. Connect to the command line on the Security Group. 2. Log in to the Expert mode. 3. Stop the CPPCAP service on all Security Group Members: `g_all /etc/init.d/start_cppcap stop` 4. Uninstall the RPM on all Security Group Members: `g_all rpm -e cp_pcap` | ### CLI Syntax {#TOC04} **Important Note** - On Scalable Platforms, the **cppcap** command does **not** support the **g_all** command (nor the **g_cppcap** command). You must move to the relevant Security Group Member and run the **cppcap** command. |-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | `cppcap -h` | | `cppcap` `-b ` `-c {0 | }` `-d {in | out}` `-D` `-f ""` `{-i | -I }` `-N` `-o [-w [-W ]]` `-p ` `-Q` `-T` `{-v | -V }` | **Parameters** Enter the string to filter this table: |------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Parameter | Description | | `-h` | Shows the built-in help. | | `-b ` | Specifies the maximum number of bytes to capture before the tool stops. | | `-c {0 | }` | Specifies the maximum number of bytes to capture in each frame. Default: 96 To remove the limit, enter the value 0 (zero). | | `-d {in | out}` | Captures traffic only in the specified direction: * `in` - Only inbound * `out` - Only outbound By default, this tool captures traffic in both directions of the connection. | | `-D` | Captures verbose data for the Datalink Layer (Layer 2). This parameter applies only if you do not use the parameter "`-o`" and show the captured traffic on the screen. This parameter does not support dynamic routing protocols. | | `-f ""` | Specifies the filter expression for traffic capture. See [pcap-filter(7)](https://linux.die.net/man/7/pcap-filter). | | `-i ` | Captures traffic only in the specified interface. To capture traffic in all interfaces, enter "`-i any`". Such traffic capture increases the CPU utilization! This parameter is mutually exclusive with the parameter "`-I `". This parameter is mandatory in: * Check Point R82 and higher | | `-I ` | Captures traffic only in all interfaces, except the specified interface. Such traffic capture increases the CPU utilization! This parameter is mutually exclusive with the parameter "`-i `". | | `-o ` | Specifies the path and the name of the output file. If you do not specify this file, the tool shows the captured traffic on the screen. To control the rotation of output files, use the parameters "`-w `" and "`-W `". | | `-N` | Captures verbose data for the Network Layer (Layer 3). This parameter applies only if you do not use the parameter "`-o`" and show the captured traffic on the screen. This parameter does not support dynamic routing protocols. | | `-p ` | Specifies the maximum number of frames to capture before the tool stops. | | `-Q` | Remove the timestamp from the traffic capture. This parameter applies only if you do not use the parameter "`-o`" and show the captured traffic on the screen. | | `-T` | Captures verbose data for the Transport Layer (Layer 4). This parameter applies only if you do not use the parameter "`-o`" and show the captured traffic on the screen. This parameter does not support dynamic routing protocols. | | `-v ` | In the VSX mode, captures traffic only in the specified Virtual System. This parameter is mutually exclusive with the parameter "`-V `". Support for this parameter is available in: * R81 and higher * R80.40 Jumbo Hotfix Accumulator, Take 38 and higher | | `-V ` | In the VSX mode, captures traffic in all Virtual Systems, except the specified Virtual System. This parameter is mutually exclusive with the parameter "`-v `". Support for this parameter is available in: * R81 and higher * R80.40 Jumbo Hotfix Accumulator, Take 38 and higher | | `-w ` `-w K` `-w M` `-w G` | Specifies the maximum size of the output file before the tool rotates this file. To use this parameter "`-w`", you must use the parameter "`-o `". * `` - Specifies the maximum size in bytes (this is the default). * `K` - Specifies the maximum size in kilobytes. * `M` - Specifies the maximum size in megabytes. * `G` - Specifies the maximum size in gigabytes. | | `-W ` | Specifies the maximum number of rotated output files. To use this parameter "`-W`", you must use the parameters "`-o -w [{K|M|G}]`". | {#Unique_IDTable} ### Usage Examples {#TOC05} |----------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------| | Example Traffic Capture | Example Syntax | | ARP and traffic with a specific host 192.168.3.57 | `cppcap -i eth0 -f "arp and host 192.168.3.57" -o /var/log/capture.pcap` | | Traffic with a specific host 192.168.3.57 - exclude SSH | `cppcap -i eth0 -f "host 192.168.3.57 and not tcp port 22"` | | ICMP with a specific host 192.168.3.57 - only in Virtual System 3 | `cppcap -i eth0 -f "icmp and host 192.168.3.57" -v 3 -o /var/log/capture.pcap` | | Traffic with a specific host 192.168.3.57 - save traffic in a maximum of 10 rotated output files, each file has a maximum size of 1 gigabyte | `cppcap -i eth0 -f "host 192.168.3.57" -W 10 -w 1G -o /var/log/capture.pcap` | ### Known Limitations {#TOC06} |-------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | ID | Description | | N/A | Capturing traffic on all interface may cause high CPU usage and potential performance issues. | | PRHF-32577, PMTR-102272 | Capturing does not require the -i or -I flags. This problem was fixed. The fix is included starting from: * [Check Point R82](https://support.checkpoint.com/results/sk/sk181127) * [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 99 * [Jumbo Hotfix Accumulator for R81.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm) starting from Take 173 |
--- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content