|
On a SPLAT machine, which is based on (RedHat) linux, the Check Point software is running as user mode process or as linux kernel module.
This modules can be shown using lsmod
[Expert@firewall]# lsmod
Module Size Used by Tainted: PF
rtmmod_smp.2.4.21.cp.i686 281120 1
bridge 27680 0 (autoclean) (unused)
vpnmod_smp.2.4.21.cp.i686 1269512 3
fwmod_smp.2.4.21.cp.i686 7858176 11
simmod_smp.2.4.21.cp.i686 827904 1
vpntmod_smp.2.4.21.cp.i686 13808 0 (unused)
e1000 126728 6
bnx2 79432 2
crc32 3592 0 [bnx2]
sg 38092 0 (autoclean) (unused)
microcode 7072 0 (autoclean)
ide-cd 35840 0 (autoclean)
cdrom 33248 0 (autoclean) [ide-cd]
dm-mod 59428 0
keybdev 3048 0 (unused)
mousedev 5688 0 (unused)
hid 22628 0 (unused)
input 5504 0 [keybdev mousedev hid]
ehci-hcd 20968 0 (unused)
usb-uhci 27308 0 (unused)
usbcore 79680 1 [hid ehci-hcd usb-uhci]
ext3 92840 5
jbd 54056 5 [ext3]
cciss 70432 12
sd_mod 14128 0 (unused)
scsi_mod 118312 2 [sg cciss sd_mod]
When Check Point is referring to the firewall kernel, they’re actually talking about this linux kernel modules.
The Check Point kernel itself is composed of several modules, which can be shown using the fw ctl debug -h command.
In NGX we had the following: - fw “Firewall Module”
- VPN “VPN Module”
- FG-1 “Floodgate-1 QoS Module”
- H323 “VoIP H.323 Module”
- BOA “Malicious Code Protection Module”
- WS “SmartDefense Web Intelligence Module”
- CPAS “Active Streaming Module”
- CLUSTER “ClusterXL Module”
- RTM “SmartView Monitor Module”
Now with R70 and Software Blades, we have some more kernel modules: - kiss ???
- kissflow ???
- multik ???
- SFT ???
- CI ???
- fw “Firewall Module”
- VPN “VPN Module”
- FG-1 “Floodgate-1 QoS Module”
- H323 “VoIP H.323 Module”
- BOA “Malicious Code Protection Module”
- WS “SmartDefense Web Intelligence Module”
- CPAS “Active Streaming Module”
- CLUSTER “ClusterXL Module”
- RTM “SmartView Monitor Module”
In the moment I have not found any reference for the new modules, no explanation of the modules itself or the modul kernel debugging options.
I opened a service request with Check Point to get this information. |
|