Technical Tip: Introduce packet capture feature

Description

This article describes how to use the sniffer feature.

Use the below command:

diagnose sniffer packet [{any | <interface_name>} [{none |'<filter_str>'}[{1|2|3}[<packets_int> <tsformat>]]]]

Scope

Packet capture can be very resource-intensive. Be sure to stop the command when you are finished.

Example:

FortiADC #diagnose sniffer packet port1 'host 192.168.0.2 or host 192.168.0.1 and tcp port 80' 1

192.168.0.2.3625 -> 192.168.0.1.80: syn 2057246590
192.168.0.1.80 -> 192.168.0.2.3625: syn 3291168205 ack 2057246591
192.168.0.2.3625 -> 192.168.0.1.80: ack 3291168206
192.168.0.2.3625 -> 192.168.0.1.80: psh 2057246591 ack 3291168206
192.168.0.1.80 -> 192.168.0.2.3625: ack 2057247265
5 packets received by filter
0 packets dropped by kernel

Solution

1. Display the packet capture timestamp, plus basic fields of the IP header: the source IP address, the destination IP address, the protocol name, and the destination port number.
2. All of the output from 1, plus the packet payload in both hexadecimal and ASCII.
3. All of the output from 2, plus the link layer (Ethernet) header.
   
   <packets_int>: number of packets to capture before stopping
   <tsformat>:  format of timestamp.
   a: absolute UTC time, yyyy-mm-dd hh:mm:ss.ms.
   l: absolute LOCAL time, yyyy-mm-dd hh:mm:ss.ms.
   otherwise: relative to the start of sniffing, ss.ms.

Note: If vdoms are used, navigate first to the vdom for the traffic in question.

Example: If traffic is required to be captured in the root VDOM:

FortiADC #config vdom

FortiADC (vdom) #edit root

FortiADC (root) #diagnose sniffer packet port1 'host 192.168.0.2 or host 192.168.0.1 and tcp port 80' 1