Technical Tip: Troubleshooting FortiDDOS B/E dropped packet issues with one-armed sniffer on FortiGate

FortiGate One-Arm Sniffer mode provides passive, out-of-band traffic capture, including dropped packets, and enables advanced troubleshooting and security analysis without impacting production traffic.

Server:

root@172.30.153.27's password: 
[root@Server ~]# cd /root/demo/be

1. while true; do ./run_non_stop_inbound_traffic.sh 1; sleep 1; done

2. while true; do tcpreplay -i eth1 --pps 20000 inbound_attack_traffic.pcap; done

Notes:

• The script is generating non-stop inbound traffic.
• Tcpreplay is sending a PCAP file at 20,000 packets per second on the eth1 interface.

Client:     

root@172.30.153.26's password: fortinet
[root@Client1 ~]# cd /root/mliu/be

1. while true; do ./run_non_stop_outbound_traffic.sh 1; sleep 1; done

2. while true; do tcpreplay -i eth1 --pps 20000 outbound_attack_traffic.pcap; done

FortiGate:

Network -> Interface.

FortiDDoS:

1. SPP-Default (prevention).
   
   

2. Enable Dropped Packet Capture on the interface.

'One-armed sniffer' check:

Related document: 

Packet Capture