Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: Dshield submissions aren't working if you have a Checkpoint Firewall SANS ISC InfoSec Forums

Participate: Learn more about our honeypot network

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Dshield submissions aren't working if you have a Checkpoint Firewall

Checkpoint Firewalls have a feature to be able submit logs directly to Dshield.  Well...  they are supposed to.

Turns out there is an issue with Checkpoint's submission process, and (as far as I know) you will not get any indication that you are not submitting logs to us.  We appreciate it when our readers submit logs into Dshield, and thusly the Internet Storm Center.  If you are trying to submit logs to us, and would like it to be native, that'd be great, however, right now, the feature isn't working. 

So, in the meantime while several of our readers have called Checkpoint support to ask that they fix this issue, please check out in order to submit your logs.  There is a module ready for Checkpoint, outside of the actual firewall software itself, and we'd love to have your logs.  Thanks!

-- Joel Esler


454 Posts
Feb 19th 2009
I had got around this by installing sendmail rpms on the SPLAT device and using the older fw1-41 scripts, but it was a real PITA finding them and then making sure that all the dependencies were satisfied. I had to install Perl as well, of course. But then we upgraded and it all went away :(. Ever since then I've just not been submitting them. Sigh.

Sign Up for Free or Log In to start participating in the conversation!