fw monitor

fw monitor -ci 20 -co 20 -e -F "<source IP>,<Source Port>,<Dest IP>,<Dest Port>,6"

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_CLI_ReferenceGuide/Topics-CLIG/FWG/fw-monitor.htm

fw monitor -e 'acccept host(1.2.3.);'

In clish

show route destination 1192.0.2.2

Expert

[Expert@SITE1-MHOFW-ch01-01:0]# g_tcpdump -nni eth1-Mgmt1 host 192.0.2.2