Trying to determined real source IP behind NAT on Checkpoint R65 Platform

That's my main goal.  I'll try that and report back.

you should be able to see it in tracker, under the record XlateDst" and XlateSrc".  you can always use the "they will call method" block them from * and see who calls and says their sutuff is broken.

OK, thanks for your help so far.  I found out what was happening, and it's not good. Currently, we use BGP for our MPLS sites.  In the diagram, I have listed 3 remote sites with fictitous IP ranges (to protect the innocent) and local IPs for the main site and DMZ.  ON the firewall, I have routes to all the remote MPLS sites to route through the PIP router.  On the PIP router, there are BGP routes to all remote sites with a default gw to the firewall (for Internet access mostly).  Here's the dilema - if a BGP site goes down, that route is removed from the PIP routers and the traffic then gw's to the firewall.  Then, the firewall tries to reroute the traffic back to the PIP router and there goes the loop.  If I do a tracert to the remote site that is down, I see the traffic go to the PIP router, then to the firewall and then it dies.  If I ping the downed site, I don't get replies back.  However, while I am pinging, if I do a tcpdump - i eth4 | grep remote site IP, I get thousands of ICMP requests per second.  This, of course, starts to fill up the non-TCP connection table there goes my problem.  How on the checkpoint, can I suppress this.  Here's the catch, I can't do too much modification to this site's architecture since it's moving soon and is in shambles already - I recently inherited this architecture, so don't laugh, I didn't design it.  I am an intermediate pro at the checkpoint, so I am looking for some checkpoint expert help here.  

Can you issue the following on the firewall?

fw ctl pstat

Also, under capacity optimisation on the firewall in dashboard, what is the connections table size set to?

I think the main issue is routing and not CP at this point bud but as you said, you are limited to what you can do with the architecture for now, so we will see what we can do at the CP level

The connection table for non-TCP connections is set to 80% now, it was 50%.  I hope my stripped down version of my network has helped so far.  I am sorry I haven't gotten back sooner, its been mayhem here today - Meetings and more meeting.  I will issue the fw command tomorrow and report back.  I am hoping that there is some mechanism on the CP that can stop this storm from happening.  I will also send my  tcpdump of the storm, but will have to replace the IP's with the fictitious ones as before; but will keep them congruent with my diagram.  Talk to you all tomorrow.