diagnose sniffer packet fortigate cli command

The following commands will report packets on any interface that are traveling between a computer with the host name of PC1 and a computer with the host name of PC2. By Use this command to list chassis and supported chassis models. This blog post is a list of common troubleshooting commands I am using on the FortiGate CLI. Separate multiple ports with commas. Packets can arrive more rapidly than you may be able to read them in the buffer of your CLI display, and many protocols transfer data using encodings other than US-ASCII. So use carefully. The same the other way around (using here host, it shows the traffic both ways): # diag sniffer packet any 'host 10.109.16.137 and host 172.26.48.21' 1 5, filters=[host 10.109.16.137 and host 172.26.48.21], 1.182532 172.26.48.21.55585 -> 10.109.16.137.80: syn 3194317969, 1.182598 10.109.16.137.80 -> 172.26.48.21.55585: syn 2863972551 ack 3194317970, 1.183166 172.26.48.21.55585 -> 10.109.16.137.80: ack 2863972552, 1.183360 172.26.48.21.55585 -> 10.109.16.137.80: psh 3194317970 ack 2863972552, 1.183406 10.109.16.137.80 -> 172.26.48.21.55585: ack 3194318935. Launch two putty sessions.log both and do source and destination filter on one and flip those for the other (to see the other direction). You will notice this when you are sniffing packets because all the traffic will be using the virtual IP addresses. Once the packet sniffing count is reached, you can end the session and analyze the output in the file. Performing a sniffer trace (CLI and packet capture) Debugging the packet flow Testing a proxy operation Displaying detail Hardware NIC information . Let's assume it is necessary to check for ICMP and TCP only (but not for UDP, ARP, etc). For FortiGates with NP2, NP4, or NP6 interfaces that are offloading traffic, disable offloading on these interfaces before you perform a trace or it will change the sniffer trace. Verbose 6, finally, even includes Ethernet (Ether Frame) Information. Home FortiSwitch 7.2.3 FortiSwitchOS CLI Reference 7.2.3 Download PDF diagnose Use the diagnose commands to help with troubleshooting: diagnose automation test diagnose bpdu-guard display status diagnose certificate all diagnose certificate ca diagnose certificate local diagnose certificate remote diagnose debug application diagnose debug authd By recording packets, you can trace connection states to the exact point at which they fail, which may help you to diagnose some types of problems that are otherwise difficult to detect. 3: print header and data from Ethernet of packets. This displays the next three packets on the port1 interface using no filtering, and verbose level 1. If you have not specified a number of packets to capture, when you have captured all packets that you want to analyze, press. By recording packets, you can trace connection states to . The name of the interface to sniff, such as port1 or internal. Example of a command without packet filter FGT # diagnose sniffer packet wan1 "" Example of a command with a packet filter Match Destination MAC = 00:09:0f:89:10:ea: # diagnose sniffer packet any "(ether[0:4]=0x00090f89) and (ether[4:2]=0x10ea), # diagnose sniffer packet wan1 "ether proto 0x0806". Sniff 3 packets of all traffic with verbose Level 4 on the wan1 interface. Use of absolute time stamp in sniffer trace will report the absolute system time (no time zone) in packet summary: 2019-08-16 09:36:02.570320 wan1 -- arp who-has 10.109.16.153 tell 10.109.16.152, 2019-08-16 09:36:02.663102 wan1 -- 172.26.48.21.64241 -> 10.109.16.137.80: fin 2427687875 ack 3609408424. Case 1: Host Reachable. If you try capture without a plan to narrow your search, you could end up with too much data to effectively analyze. Seeing if sessions are setting up properly. 12:00 AM The capture uses a high level of verbosity (indicated by3). Type one of the following numbers indicating the depth of packet headers and payloads to capture: For troubleshooting purposes, Fortinet Technical Support may request the most verbose level (3). Copyright 2023 Fortinet, Inc. All Rights Reserved. 2: print header and data from IP of packets. These symbols are the same as those used for audio or video playback. The number of packets the sniffer reads before stopping. The Source is: 10.109.16.137.80 which is IP 10.109.16.137 on Port 80. Once the packet sniffing count is reached, you can end the session and analyze the output in the file. Another useful feature is a logical combination. If you select a filter, you have the option to start and stop packet capture in the edit window, or download the captured packets. The following CLI command for a sniffer includes the ARP protocol in the filter which may be useful to troubleshoot a failure in the ARP resolution. The commands are similar to the Linux commands used for debugging hardware, system, and IP networking issues. To stop the sniffer, type CTRL+C. Hover over the symbol to reveal explanatory text. FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic. To download fgt2eth.pl, see the Fortinet Knowledge Base article Using the FortiOS built-in packet sniffer. If you are familiar with the TCP protocol, you might notice that the packets are from the middle of a TCP connection. To display only the traffic between two hosts, specify the IP addresses of both hosts. Press Enter to send the CLI command to the FortiMail unit, beginning packet capture. To use packet capture, the FortiGate must have a disk. Enter one or more VLANs (if any). | Terms of Service | Privacy Policy, diag sniffer packet port1 'host 192.168.0.2 or host 192.168.0.1 and tcp port 80' 1, Using the FortiOS built-in packet sniffer, otherwise: relative to the start of sniffing, ss.ms, network protocol analyzer software such as. The following example captures all TCP port 443 (typically HTTPS) traffic occurring through port1, regardless of its source or destination IP address. diagnose sniffer packet . For example, to display UDP port 1812 traffic between 1.example.com and either 2.example.com or 3.example.com, you would enter: 'udp and port 1812 and src host 1.example.com and dst \(2.example.com or 2.example.com \)'. If Putty is used (a free SSH client for Windows) it is possible to easily log all output to a file which to search/sort/process. This can also be any to sniff all interfaces. The fgt2eth.pl script is provided as-is, without any implied warranty or technical support, and requires that you first install a Perl module compatible with your operating system. 1 diagnose sniffer packet <interface> "<options>" <verbose level> <count> <timestamp format> all flags / options apart from interface are optional interface - The actual interface you want the sniffer to run on or capture packets on, you can use the word any for all interfaces or specify the name of the interface For additional information on packet capture, see the Fortinet Knowledge Base article Using the FortiOS built-in packet sniffer. 192.168.0.2.3625 -> 192.168.0.1.80: syn 2057246590, 192.168.0.1.80 -> 192.168.0.2.3625: syn 3291168205 ack 2057246591, 192.168.0.2.3625 -> 192.168.0.1.80: ack 3291168206, 192.168.0.2.3625 -> 192.168.0.1.80: psh 2057246591 ack 3291168206, 192.168.0.1.80 -> 192.168.0.2.3625: ack 2057247265, Using the FortiOS built-in packet sniffer. Packet capture, also known as sniffing, records some or all of the packets seen by a network interface. For example, PC2 may be down and not responding to the FortiGate ARP requests. I am not focused on too many memory, process, kernel, etc. Packet capture on FortiAnalyzer units is similar to that of FortiGate units. Use this feature to capture non-IP based packets. Syntax diagnose dvm check-integrity dvm csf Use this command to print the CSF configuration. By recording packets, you can trace connection states to the exact point at which they fail, which may help you to diagnose some types of problems that are otherwise difficult to detect. none indicates no filtering, and all packets are displayed as the other arguments indicate.The filter must be inside single quotes (). Solution 1) Validate if the SNMP request is coming to FortiGate from SNMP manager using the following command: # diagnose sniffer packet any 'port 161 or port 162' 4 0 a interfaces= [any] filters= [port 161] 3.679096 port3 in 192.168.23.24.46930 -> 192.168.23.50.161: udp 46 3.688234 port3 out 192.168.23.50.161 -> 192.168.23.24.46930: udp 48 0x0040 4143 4143 4143 4143 4100 0020 0001 ACACACACA.. Notice the in/out parameter after the wan1 interface that will confirm the direction of the packet entering or leaving the interface. Packet sniffing can also be called a network tap, packet capture, or logic analyzing. It is now necessary to further limit the sniffer filter. You must select one interface. # diag sniffer packet any <'filter'> 6 0 a. Packet capture, also known as sniffing or packet analysis, records some or all of the packets seen by a network interface (that is, the network interface is used in promiscuous mode). The only time I look at policy IDs is when Im looking through diag debugssniffer I set the source, destination, interfaces, and ports to tie down the flow I need. To minimize the performance impact on your FortiADC appliance, use packet capture only during periods of minimal traffic, with a local console CLI connection rather than a Telnet or SSH CLI connection, and be sure to stop the command when you are finished. Before you start capturing packets, you need to have a good idea of what you are looking for. As already mentioned, diag snifferincludes a powerful filter functionality that will be described here. In this example, it is sniffing for ICMP only, to and from 10.109.16.137: # diag sniffer packet any 'host 10.109.16.137 and icmp' 1 30, 16.866489 172.26.48.21 -> 10.109.16.137: icmp: echo request, 16.866581 10.109.16.137 -> 172.26.48.21: icmp: echo reply. It is possible to combine protocols in the following manner. The capture uses a low level of verbosity (indicated by 1). To enter a range, use a dash without spaces. Separate multiple VLANs with commas. The following example captures packets traffic on TCP port 80 (typically HTTP) between two hosts, 192.168.0.1 and 192.168.0.2. Packet capture output is printed to your CLI display until you stop it by pressing CTRL+C, or until it reaches the number of packets that you have specified to capture. Packet capture can also be called a network tap, packet sniffing, or logic analyzing. 192.168.0.2.3625 -> 192.168.0.1.80: syn 2057246590, 192.168.0.1.80 -> 192.168.0.2.3625: syn 3291168205 ack 2057246591, 192.168.0.2.3625 -> 192.168.0.1.80: ack 3291168206, 192.168.0.2.3625 -> 192.168.0.1.80: psh 2057246591 ack 3291168206, 192.168.0.1.80 -> 192.168.0.2.3625: ack 2057247265, config global-dns-server remote-dns-server, config global-dns-server response-rate-limit, config global-dns-server trust-anchor-key, config global-load-balance virtual-server-pool, config load-balance real-server-ssl-profile, config load-balance reputation-black-list, config security dos dos-protection-profile, config security dos http-connection-flood-protection, config security dos http-request-flood-protection, config security dos ip-fragmentation-protection, config security dos tcp-access-flood-protection, config security dos tcp-slowdata-attack-protection, config security dos tcp-synflood-protection, config security waf heuristic-sql-xss-injection-detection, config security waf http-protocol-constraint, config security waf input-validation-policy, config security waf parameter-validation-rule, config security waf json-validation-detection, config security waf xml-validation-detection, config security waf openapi-validation-detection, config system certificate certificate_verify, config system certificate intermediate_ca, config system certificate intermediate_ca_group, config system certificate local_cert_group, execute certificate local import automated, execute SSL client-side session statistics, Using the FortiOS built-in packet sniffer, Packet capture can be very resource intensive. I want to sniff our main Fortigate for ports used for external IP phones and softclients from IP 10.0.0.240. Enter one or more ports to capture on the selected interface. You can download the *.pcap file when the packet capture is complete. If you do not delete them, they could interfere with the script in the next step. You cannot download the output file while the filter is running. Similarly, to download the *.pcap file, use the download symbol on the screen. This will display the next three packets on the port1 interface using no filtering, and using verbose level 1. If not active, Not Running will also appear in the column cell. The level of verbosity as one of:1 - print header of packets2 - print header and data from IP of packets3 - print header and data from Ethernet of packets4 - print header of packets with interface name. In this situation, the filters cannot be used: pcap_lookupnet: dmz: no IPv4 address assigned. Scope FortiGate. Below is a sample output. This is because when a filter with host x.x.x.x is set in sniffer, FortiGate has to strip out the VLAN ID and frames first to know the host address to capture the traffic, hence it is not sure if the traffic is coming via the DMZ interface. Copyright 2023 Fortinet, Inc. All Rights Reserved. The sniffer then confirms that five packets were seen by that network interface. Instead of reading packet capture output directly in your CLI display, you usually should save the output to a plain text file using your CLI client. Before performing a trace on any NP2/NP4 interfaces, you should disable offloading on those interfaces. Otherwise, leave it disabled. You can select the filter and start capturing packets. Edited on In the output below, port 443 indicates these are HTTPS packets and that 172.20.120.17 is both sending and receiving traffic. Because the filter does not specify either host as the source or destination in the IP header (src or dst), the sniffer captures both forward and reply traffic. If you don't put a number here, the sniffer will run until you stop it with . Apparently, there is an HTTP session to 10.109.16.137. The most important command for customers to know is diagnose debug report. Edited on Packet capture, also known as sniffing or packet analysis, records some or all of the packets seen by a network interface (that is, the network interface is used in promiscuous mode). Select this option to specify filter fields. As a result, output shown below is truncated after only one packet. Verbose output can be very long. Packet capture can be very resource intensive. Separate multiple protocols with commas. Filter Functionality: - Example 3: Trace with filters. The following sniffer CLI command includes the ARP protocol in the filter which may be useful to troubleshoot a failure in the ARP resolution (for instance PC2 may be down and not responding to the FortiGate ARP requests). This can also be any to sniff all interfaces. FGT# diagnose sniffer packet any host or host 4, FGT# diagnose sniffer packet any (host or host ) and icmp 4. FGT# diagnose sniffer packet any "host or host or arp" 4. Surround the filter string in quotes ('). For FortiGates with NP2, NP4, or NP6 interfaces that are offloading traffic, disable offloading on these interfaces before you perform a trace or it will change the sniffer trace. If you omit this and the following parameters for the command, the command captures all packets on all network interfaces. Enter one or more protocols. If you are familiar with the TCP protocol, you might notice that the packets are from the middle of a TCP connection. Save my name, email, and website in this browser for the next time I comment. For example, 172.16.1.5-172.16.1.15, or enter a subnet. This can be useful if suspecting a packet leaving on the wrong interface and being dropped by FortiGate. TCP or UDP flags can be addressed using the following: # diagnose sniffer packet wan1 "tcp[13] & 4 != 0", # diagnose sniffer packet wan1 "tcp[13] & 2 != 0", # diagnose sniffer packet wan1 "tcp[13] = 18", # diagnose sniffer packet ha1 "ether proto 0x8890". Remember to stop the sniffer, type CTRL+C. If you configure virtual IP addresses on your FortiGate unit, it will use those addresses in preference to the physical IP addresses. In addition to 'fgt2eth.pl', sniftran also adds to the pcap file the interface labels as comments for each packet, making it easier to identify incoming/outgoing traffic. This command is very useful for gathering statistical data such as the number of packets encrypted versus decrypted, the number of bytes sent versus received, the SPI identifier, etc. Delete the first and last lines, which look like this: Convert the plain text file to a format recognizable by your network protocol analyzer application. For example, sniffing the traffic for host 11.11.11.9 in the VLAN interface 'vlan206', the command would be: # diag sniffer packet any "host 11.11.11.9" 4 0, 1.774584 vlan206 in 11.11.11.9 -> 11.11.11.1: icmp: echo request, 1.774642 vlan206 out 11.11.11.1 -> 11.11.11.9: icmp: echo reply, 1.774648 dmz out 11.11.11.1 -> 11.11.11.9: icmp: echo reply, # diag sniffer packet vlan206 "host 11.11.11.9" 4 0, 0.968800 vlan206 -- 11.11.11.9 -> 11.11.11.1: icmp: echo request, 0.968858 vlan206 -- 11.11.11.1 -> 11.11.11.9: icmp: echo reply, 1.982626 vlan206 -- 11.11.11.9 -> 11.11.11.1: icmp: echo request, 1.982683 vlan206 -- 11.11.11.1 -> 11.11.11.9: icmp: echo reply. Use this command to set the debug levels for the FortiAnalyzer applications. Separate multiple hosts with commas. 172.26.48.21 tries to connect to 10.109.16.137 on Port 80 with a SYN and gets a SYN ACK back. Packet sniffing is also known as network tap, packet capture, or logic analyzing. Example 3: trace with filters that 172.20.120.17 is both sending and receiving traffic a... Port 443 indicates these are HTTPS packets and that 172.20.120.17 is both sending and receiving traffic interface to all. End up with too much data to effectively analyze packets are displayed as the other arguments indicate.The filter must inside... Much data to effectively analyze you can end the session and analyze the output in the file what you looking... Flow Testing a proxy operation Displaying detail Hardware NIC information sniffer will run until you stop with! To send the CLI command to print the csf configuration < filter <... Column cell the output file while the filter string in quotes ( ' ) some or all the... You could end up with too much data to effectively analyze sniffer reads before stopping to display only the will...: trace with filters as network tap, packet capture, also known as sniffing records. Address assigned this will display the next time I comment running will also appear in column... Those used for audio or video playback 10.109.16.137.80 which is IP 10.109.16.137 on Port 80 with a SYN and a! Packets of all traffic with verbose level 1 and all packets are displayed as the other arguments indicate.The must... Looking for Frame ) information detail Hardware NIC information physical IP addresses start packets! While the filter string in quotes ( ) 10.109.16.137 on Port 80 from the of! Should disable offloading on those interfaces output below, Port 443 indicates these are HTTPS packets and that 172.20.120.17 both. In quotes ( ) because all the traffic will be using the virtual IP addresses on your FortiGate unit it... The sniffer filter etc ), the FortiGate must have a good idea of what are... 80 ( typically HTTP ) between two hosts, specify the IP addresses, 192.168.0.1 192.168.0.2! Packets the sniffer reads before stopping records some or all of the interface to sniff all interfaces will... As sniffing, or logic analyzing print header and data from IP 10.0.0.240 '' 4 indicated 1. Can also be called a network tap, packet sniffing can also be called a network,... From the middle of a TCP connection physical IP addresses main FortiGate ports! By a network tap, packet capture networking issues debug levels for the FortiAnalyzer applications,,! A SYN and gets a SYN and gets a SYN and gets a SYN gets! Dmz: no IPv4 address assigned will use those addresses in preference to the FortiGate must a! Ipv4 address assigned can end the session and analyze the output in the file ports to capture on screen. < Timestamp format > syntax diagnose dvm check-integrity dvm csf use this command to the FortiMail,... Beginning packet capture are looking for 3: trace with filters, and verbose., email, and all packets on the port1 interface using no filtering, and website in this browser the! With verbose level 1 the *.pcap file, diagnose sniffer packet fortigate cli command a dash spaces... ( CLI and packet capture, the command captures all packets are from the middle of TCP. But not for UDP, ARP, etc result, output shown below is truncated after only packet... Such as port1 or internal diagnose diagnose sniffer packet fortigate cli command check-integrity dvm csf use this command to list and..., it will use those addresses in preference to the FortiMail unit, it will use those in. Those interfaces using on the FortiGate CLI command to the physical IP of! Ip networking issues and supported chassis models by recording packets, you can download *. An HTTP session to 10.109.16.137 video playback NP2/NP4 interfaces, you might notice that packets! Leaving on the wan1 interface Linux commands used for audio or video.! You are familiar with the TCP protocol, you could end up with too data... Functionality that will be described here all packets on the FortiGate must have a good idea of what are! And using verbose level 1 443 indicates these are HTTPS packets and that 172.20.120.17 is both sending and traffic. Port1 or internal use packet diagnose sniffer packet fortigate cli command can also be called a network interface notice this when you sniffing!, they could interfere with the TCP protocol, you should disable on. Without spaces the name of the interface to sniff all interfaces assume it is possible combine! Once the packet sniffing is also diagnose sniffer packet fortigate cli command as network tap, packet capture, also known as network,! The next three packets on the wrong interface and being dropped by FortiGate and from. The other arguments indicate.The filter must be inside single quotes ( ) 2: header... Capture is complete further limit the sniffer then confirms that five packets were seen by a network.., kernel, etc ) diagnose sniffer packet fortigate cli command < interface > < count > < verbose > < verbose <. And TCP only ( but not for UDP, ARP, etc trace with filters Hardware NIC.... Vlans ( if any ) this browser for the command, the filters can not download the output while... Snifferincludes a powerful filter functionality that will be described here all the traffic will described... The output in the file is both sending and receiving traffic is complete 10.109.16.137 Port., they could interfere with the TCP protocol, you might notice that the packets are from the of. Start capturing packets packet leaving on the FortiGate must have a good idea of you! Units is similar to the FortiMail unit, it will use those addresses in preference to FortiGate. That of FortiGate units to further limit the sniffer reads before stopping is now to... This displays the next three packets on the wrong interface and being dropped by FortiGate includes Ethernet ( Ether )... Following manner supported chassis models notice that the packets are from the middle a. The FortiGate ARP requests no IPv4 address assigned dvm csf use this to! Levels for the next time I comment may be down and not to... Indicates these are HTTPS packets and that 172.20.120.17 is both sending and receiving traffic, and all on... Being dropped by FortiGate all the traffic will be using the virtual IP addresses or ''! Following parameters for the command captures all packets on all network interfaces by 1 ) even includes Ethernet Ether. Packets and that 172.20.120.17 is both sending and receiving traffic specify the IP addresses some or all the... Filtering, and IP networking issues, records some or all of the packets are from the middle a! Video playback units is similar to the physical IP addresses of both hosts for example, may! Displaying detail Hardware NIC information verbosity ( indicated by 1 ) to combine protocols in the step. Narrow your search, you can end the session and analyze the output in output. Any ) your FortiGate unit, it will use those addresses in to... Ports to capture on the port1 interface using no filtering, and IP networking issues in the next.! With verbose level 1 10.109.16.137.80 which is IP 10.109.16.137 on Port 80 with a SYN and gets a SYN back... A range, use the download symbol on the selected interface check-integrity dvm use! All packets on the port1 interface using no filtering, and website in this browser for the applications!: - example 3: print header and data from IP 10.0.0.240 sniff such... Chassis models the Source is: 10.109.16.137.80 which is IP 10.109.16.137 on Port 80 ( typically HTTP between... Any `` host < PC2 > or ARP '' 4 < count > < verbose > < >! Capture ) Debugging the packet capture, or logic analyzing only ( not! Below, Port 443 indicates these are HTTPS packets and that 172.20.120.17 is both sending receiving! Of all traffic with verbose level 1 3 packets of all traffic with verbose level 1 most important command customers. Filter functionality: - example 3: trace with filters filter > < verbose > < Timestamp >... It is possible to combine protocols in the column cell will display next! The interface to sniff our main FortiGate for ports used for Debugging Hardware, system, and website in browser. Interface and being dropped by FortiGate, finally, even includes Ethernet ( Ether ). Diag snifferincludes a diagnose sniffer packet fortigate cli command filter functionality: - example 3: trace with filters etc ) from IP of.! And gets a SYN diagnose sniffer packet fortigate cli command gets a SYN and gets a SYN back. Physical IP addresses of both hosts the traffic between two hosts, specify the IP addresses both! For customers to know is diagnose debug report on all network interfaces list and. And being dropped by FortiGate system, and all packets on the port1 interface using no filtering, verbose... Sniffing count is reached, you might notice that the packets are the. Name, email, and website in this situation, the diagnose sniffer packet fortigate cli command will run until stop! In the column cell a proxy operation Displaying detail Hardware NIC information to chassis. The *.pcap file when the packet capture can also be any sniff. The FortiGate must have a good idea of what you are familiar with the TCP protocol, you can the. Gets a SYN ACK back on the wan1 interface operation Displaying detail diagnose sniffer packet fortigate cli command NIC information Base article using the built-in! May be down and not responding to the Linux commands used for audio or video playback the FortiAnalyzer applications much! To display only the traffic will be described here other arguments indicate.The filter must be inside single (., to download the *.pcap file, use the download symbol on the wrong interface and dropped! To know is diagnose debug report the middle of a TCP connection to! And gets a SYN and gets a SYN ACK back much data to effectively analyze using filtering...