156-835 · Question #54
What is the purpose of g_tcpdump command?
The correct answer is D. Collects traffic dump from all Active Appliances within Security Group. See the full explanation below for the reasoning.
Question
What is the purpose of g_tcpdump command?
Options
- ACollects traffic dump from Sync network
- BThe same as tcpdump, just on Scalable Platform
- CCollects traffic dump from CIN network
- DCollects traffic dump from all Active Appliances within Security Group
How the community answered
(32 responses)- A9% (3)
- B16% (5)
- C3% (1)
- D72% (23)
Community Discussion
5
Yusuf A.May 26, 2026D is the right answer. The "g" in g_tcpdump stands for "group," so instead of capturing traffic on just one appliance like regular tcpdump does, it runs across all active appliances in the Security Group at the same time, which is exactly what you need when traffic can land on any member of the group.
Mateus R.May 28, 2026Good catch on the parallel capture behavior, but the "g" stands for "global" not "group," though in practice the distinction barely matters since the result is the same either way: you get visibility across the whole cluster instead of just one box.
Mateus R.May 17, 2026Think of a Security Group in a Maestro environment like a restaurant kitchen with multiple chefs all working the same service. If you want to know what every chef is cooking at once, you do not walk up to just one station, you shout across the whole kitchen. That is what the "g_" prefix does in Check Point Scalable Platform commands, it broadcasts the operation globally across all Active Appliances inside the Security Group simultaneously, so you get one unified traffic capture instead of logging into each member one by one. The plain tcpdump command only sees traffic on the specific appliance you are sitting on, which on a Maestro setup could be just a slice of what is actually flowing through the group. Here is my question for you, and think carefully before you answer because it trips people up: if a connection gets load-balanced to Appliance 3 but you ran g_tcpdump while logged into the Security Group Management module, which appliances actually report back their captures, and does that include standby members that are not actively processing traffic right now?
Mei-Ling H.May 18, 2026Worth adding for the exam: the key word in the official documentation is "Active," so g_tcpdump collects from all active Security Group Members simultaneously, meaning every active appliance including Appliance 3 reports back, but standby members are excluded, and that "active vs. standby" distinction is exactly the kind of qualifier word that shows up as a wrong answer trap.
Mei-Ling H.May 23, 2026I saw this exact question on my 156-835 and almost picked B because "same as tcpdump just on Scalable Platform" sounds plausible, but the "g_" prefix is the hint, it stands for group-level scope, and the word "all Active Appliances within Security Group" is what separates D from A and C which are both narrower network-specific dumps. D is the only answer that captures the full scope the command actually operates on.