> Source: [sk98820](https://support.checkpoint.com/results/sk/sk98820)

# sk98820 - How to submit a False Positive case for IPS protections

| Property | Value |
|----------|-------|
| Solution ID | sk98820 |
| Date Created | 2014-03-10 |
| Last Modified | 2021-01-04 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- Multiple logs of a specific IPS protection that triggered on legitimate traffic can be suspected as false positives

## Cause

Network traffic triggered a specific protection although it's legitimate traffic.

## Solution

Collect the following information and [contact Check Point Support](http://www.checkpoint.com/support-services/contact-support/index.html) to analyze whether it is a false positive:

1. Customer's software version and installed hotfixes
2. IPS Package Number - Mandatory
3. Protection name - Mandatory
4. Screenshot and complete text of the log in SmartLog / SmartView Tracker - Mandatory
5. Traffic capture - Mandatory

**Which information to collect and how:**

1. **Customer's software version and installed hotfixes**   

   * For Security Management Server / Multi-Domain Security Management Server, connect over SSH and run these commands:  

     `# fwm ver`  
     `# fwm mds ver`  
     `# cpinfo -y all`  

     and copy the output  

   * For Security Gateway/ClusterXL, connect over SSH and run these commands:  

     `# fw ver`  
     `# fw ver -k`  
     `# cpinfo -y all`  

2. **IPS Package Number**   

   Connect with SmartDashboard to the Security Management Server / Domain Management Server - go to the 'IPS' tab - 'Download Updates', and take a screenshot of the Update version.  

   **Note:** In R80.x, to get IPS package number, run `ips stat` on the problematic gateway.  

3. **Protection name**   

   The exact protection name as appears in SmartDashboard - 'IPS' tab - 'Protections'.  

   You can see it in the 'Protection' name field when opening the log in SmartLog / SmartView Tracker.  

4. **Screenshot and complete text of the log in SmartLog / SmartView Tracker**   

   Open the false positive log in SmartLog / SmartView Tracker and take a screenshot.  
   In the log window, there is a special button to copy the log's text.  

5. **Traffic capture**   

   During the issue (when the false positive log is generated), connect to the Security Gateway over SSH and run [tcpdump](https://linux.die.net/man/8/tcpdump) for short period of time (1 minute or less) on the Security Gateway's external interface:  

   `# tcpdump -s 0 -n -i eth<X> -w /var/log/tcpdump.cap not tcp port 22`  

Prior to submitting a false positive case, check the type and confidence of the protection:

* If the Protection's Confidence in SmartDashboard is Low or Medium-Low, this means that it is not fully reliable and prone to false positives.

* Such protections are therefore not a part of the recommended profile, and submitting a false positive case will not necessarily help improving them.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content