FORTIGATE - Packet Sniffer

Verbose Levels Detail

• 1: print header of packets.
• 2: print header and data from IP of packets.
• 3: print header and data from Ethernet of packets.
• 4: print header of packets with interface name.
• 5: print header and data from IP of packets with interface name.
• 6: print header and data from Ethernet of packets with interface name.

Basic Sniffing Command

diag sniffer packet <interface> <'filter'> <verbose> <count> a

• <interface> can be an interface name or 'any' for all interfaces.

• <'filter'> is a very powerful filter functionality which will be described in more detail.

• <verbose> means the level of verbosity as described already.

• <count> the number of packets the sniffer reads before stopping.

• a – timestamps the packets with the absolute UTC time.

• l - (small letter L) timestamps the packets with LOCAL time.

Full Examples

diag sniffer packet any "host 3.210.115.14 and icmp" 4 l 0

diag sniffer packet wan1 'host 10.109.16.137 and (icmp or tcp)' 1

diag sniffer packet wan1 'host 10.109.16.137 and host 172.26.48.21 and tcp port 80' 1 3

Usefull Links

• https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Using-the-FortiOS-built-in-packet-sniffer/ta-p/194222

• https://infosecmonkey.com/quick-tip-how-to-run-sniffer-on-fortigate-cli/