Is there an equivalent command/function either from CLI or SmartDashboard similar to the ASA 'packet-tracer' command?

For those unfamiliar with 'packet-tracer' - in the ASA CLI we are able to test flows in this manner:

packet-tracer input INSIDE tcp 1025 80 det

Where the RFC1918 address is the source, and is the destination. This command is used to verify rule input and assess which rules a given flow is either being allowed or denied by.

  • 1
    For those not too familiar with the ASA it may be useful to add a description of what this command does and you're looking for, to improve your chance of getting useful answers.
    – Teun Vink
    Commented Jun 4, 2015 at 19:40
  • Great suggestion, edited !
    – A L
    Commented Jun 4, 2015 at 20:34
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin
    Commented Dec 31, 2020 at 4:45

2 Answers 2


Checkpoint has the fw monitor command which should provide similar informations. This reference looks pretty good.


fw monitor is not equivalent. If you want to check (in limited way compared to ASA) whether packet will be allowed/dropped + and by which rule(s) use command fw up_execute from EXPERT mode of checkpoint CLI. Example: #fw up_execute src= dst= ipp=6 dport=443

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.