Technical Tip: How to sniff traffic using FortiOS GUI and advanced filters

To sniff traffic using FortiOS GUI, it is necessary to navigate to Network -> Diagnostics -> Packet capture, hit the button New packet capture, enable Filters, and hit the Advanced button.

Advanced filtering parameters should follow the same syntax as when running the 'diagnose sniffer packet' in the CLI (example: udp or tcp).

Putting the whole command (example: 'diagnose sniffer packet any "udp" 6 0 a or filters in quotes 'udp or tcp"/'udp or tcp') will return an error.

Example with Layer 3 Addresses:

The filter can be used with layer 3 addresses as well for filtered searches.

• For a single destination and ICMP use: icmp and host 8.8.8.8
• For multiple destinations and ICMP use: icmp and host 8.8.8.8 or host 1.1.1.1
• For source and destination IPs with icmp use: icmp and host 8.8.8.8 and host 1.2.3.4
• For all traffic except one IP use: any 'not host 192.168.x.x' 4
• For IP and exclude ICMP use: any 'src net 192.168.1.0/24 and dst net 0.0.0.0/0 and not icmp' 4

Note:

The advanced filters option is available only for Super Administrator profiles.