Short answer: Check Point Gaia doesn't ship mtr, and adding third-party packages to Gaia is unsupported. Use traceroute and ping on the gateway, asg_tracert on Maestro or Chassis, and an online MTR or a Linux or Windows host for packet loss per hop.
Traceroute and ping on Gaia
# Expert mode
traceroute 8.8.8.8
traceroute -n -q 5 8.8.8.8
ping -c 100 8.8.8.8Options differ slightly between Gaia versions. Check traceroute --help on your gateway. Use -n to skip DNS lookups and get faster output, and a ping count of 100 for a meaningful loss percentage.
Maestro and Scalable Chassis: asg_tracert
asg_tracert 8.8.8.8In a Security Group, traffic stickiness can make the native traceroute misleading. asg_tracert handles that and takes the same options as the native command.
Get MTR-style results anyway
- Traceroute from the gateway to list the hops.
- Ping the destination 100 times. 0% loss means the path is healthy.
- If there's loss, ping each hop to find where it starts and continues.
- Run the HardcoreDebug MTR to the gateway's external IP or VPN endpoint for the inbound path.
Remote access VPN and site-to-site tunnels
For remote access users, test TCP 443 to the gateway's public address from outside, and compare with a pathping or WinMTR from the user's laptop. For site-to-site VPN, test between the two peers' public IPs. Loss on that path shows up as tunnel instability. See also our MTR command guide.
Frequently asked questions
Can I run mtr on a Check Point gateway?
Gaia does not include mtr, and installing extra software on Gaia is not supported by Check Point. Use traceroute and ping in Expert mode or clish, and run MTR from another machine or an online MTR for loss per hop.
What is asg_tracert?
On Maestro and Scalable Chassis (Security Groups), Check Point provides asg_tracert, because the native traceroute can give misleading results in a Security Group. It accepts the native traceroute options.
Why does traceroute through the gateway show no hops?
The gateway's policy may drop ICMP time-exceeded replies or the probe protocol. Try TCP probes, or test from outside the gateway with a TCP MTR on an allowed port.