156-587 · Question #118
You need to monitor traffic pre-inbound and before the VPN module in a Security Gateway. How would you achieve this using fw monitor?
The correct answer is B. fw monitor -pi -vpn. The fw monitor command is a powerful troubleshooting tool in Check Point Gateways that captures packets at various points in the processing chain. The question asks how to capture traffic pre-inbound (before inbound processing, i.e., at the "i" inspection point) and before the…
Question
You need to monitor traffic pre-inbound and before the VPN module in a Security Gateway. How would you achieve this using fw monitor?
Options
- Afw monitor -p all
- Bfw monitor -pi -vpn
- Cfw monitor -pi +vpn
- Dfw monitor -pi +vpn
How the community answered
(65 responses)- A3% (2)
- B78% (51)
- C12% (8)
- D6% (4)
Explanation
The fw monitor command is a powerful troubleshooting tool in Check Point Gateways that captures packets at various points in the processing chain. The question asks how to capture traffic pre-inbound (before inbound processing, i.e., at the "i" inspection point) and before the VPN module (before VPN decryption or processing). The fw monitor syntax allows specifying inspection points using options like -pi (pre-inbound) and module names (e.g., -vpn for the VPN module). The correct syntax to capture traffic before a specific module is -pi -<module>, where the module name is prefixed with a minus sign to indicate "before" the module. fw monitor -pi -vpn captures packets at the pre-inbound inspection point ("i") and before the VPN module (-vpn). The -pi specifies the pre-inbound point, and -vpn ensures the capture occurs before VPN processing (e.g., decryption).
Topics
Community Discussion
6
Mei-Ling H.May 16, 2026The answer is B, fw monitor -pi -vpn, because the lowercase -p flag with "i" sets the capture point to pre-inbound (before the Security Policy), and the minus sign in -vpn tells the tool to capture traffic before the VPN module processes it, which is exactly what the question asks for. The plus sign in options C and D would mean after the VPN module, so that minus versus plus distinction is the whole test here.
Brenda K.May 7, 2026B is cold wrong on its face, C and D are identical, but B still wins: -pi captures pre-inbound, -vpn means before VPN.
Ola B.May 14, 2026fw monitor uses position flags, so does -pi mean pre-inbound or post-inbound to you?
Wesley A.May 15, 2026-pi is pre-inbound, meaning the packet is captured before the inbound security policy hits it, and that distinction burned me on my first attempt when I assumed "i" alone was enough to see drops that were actually happening in the policy itself.
Wesley A.May 12, 2026The lowercase i in -pi targets pre-inbound specifically, and the +vpn flag adds the capture point before the VPN module processes the packet, which is exactly the two-stage capture scope the question is describing. I got burned on this one the first time because I mixed up the plus and minus prefix logic for VPN, but once I tested it in the lab it clicked.
Brenda K.May 13, 2026Wesley, the correct answer is B, and the key is that the plus prefix on the VPN flag positions the capture point after the VPN module, not before it, which matches the post-decryption scope the question is actually testing. Your lab work was close, but the prefix logic you landed on is inverted from what the question specifies.