Check Point released a new tool called CPPCAP as an alternative for the well known Linux tool tcpdump. In sk141412 they explain that tcpdump causes a significant increase in CPU usage which will impact performance of the device.
CPPCAP will not run on 32-bit Gaia OS. You must enable 64-bit kernel to be able to use it.
SecureXL does not need to be turned off before using CPPCAP as stated here on Check Mates.
For examples of filters you can read the pcap-filter manpage here.
Links to the RPM packages of CPPCAP can be found in sk141412.