FORTIGATE - Packet Debug Flow

FortiOS 6.2.12 Cookbook / FortiOS 7.4.3 Administration Guide

Quick Example

To start flow monitoring with a specific number of packets :

diagnose debug flow trace start <N>

To stop flow tracing at any time :

diagnose debug flow trace stop

The following example shows the flow trace for a device with an IP address of W.X.Y.Z :

diagnose debug enable
diagnose debug flow filter addr W.X.Y.Z
diagnose debug flow show function-name enable
diagnose debug flow trace start 100

Diagnose Debug Flow Command

To follow packet flow by setting a flow filter:

# diagnose debug flow {filter | filter6} <option>

• Enter filter if your network uses IPv4.

• Enter filter6 if your network uses IPv6.

Replace <option> with one of the following variables:

Variable Description :

addr		IPv4 or IPv6 address
clear		clear filter
daddr		destination IPv4 or IPv6 address
dport		destination port
negate		inverse IPv4 or IPv6 filter
port		port
proto		protocol number
saddr		source address
sport		source port
vd			index of virtual domain; -1 matches all

Usefull Links

• https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/54688/debugging-the-packet-flow
• https://docs.fortinet.com/document/fortigate/6.2.12/cookbook/54688/debugging-the-packet-flow