Which of the following is a valid way to capture packets on Check Point gateways?

tcpdump is a standard, command-line packet capture utility available on the Check Point Gaia operating system. It allows administrators to capture raw network packets directly from the gateway's network interfaces at the OS kernel level. This is a fundamental tool for network troubleshooting, enabling the capture of traffic before it is processed by the Check Point firewall kernel's inspection points. While Check Point also provides the proprietary fw monitor utility for more in-depth inspection chain analysis, tcpdump remains a valid and officially documented method for packet capture on the gateway itself.

A. Firewall logs record connection metadata and policy enforcement decisions (accept, drop), not the full content of the network packets.

B. Wireshark is a graphical tool for analyzing packet capture files; it does not run on the gateway to perform the actual capture.

D. Network taps are external hardware devices that physically intercept and copy network traffic; they are not a method used on the gateway.

1. Check Point Support Center, SecureKnowledge sk30583, "How to use tcpdump": This official document explicitly provides instructions and examples for using the tcpdump command on Check Point Security Gateways running Gaia/IPSO/SecurePlatform for packet capture. It details syntax, flags, and usage scenarios.

2. Check Point Support Center, SecureKnowledge sk65364, "How to use fw monitor": This article, while focused on fw monitor, contrasts it with tcpdump, stating, "tcpdump shows packets as they are received and sent by the network interface card driver... before they are processed by the firewall." This confirms tcpdump as a valid capture tool on the gateway.

3. Check Point Gaia R81.20 Administration Guide, Chapter "Command Line Interface": The guide documents the availability of standard Linux utilities within the Gaia Clish and expert mode shells. tcpdump is a fundamental utility included in the underlying operating system, accessible via expert mode for advanced troubleshooting. (Reference: General availability of standard Linux tools in expert mode).