Staff

Technical Tip: Tracking the real-time traffic data for a specific interface in FortiGate

Forum|Forum|1 year ago
July 24, 2025
0 replies
1275 views

Description

This article describes how to track the real-time data for a specific interface in FortiGate. The results will also be compared with the bandwidth graph information in the GUI.

Scope

FortiGate v7.4.3 or older.

Solution

Enable monitor bandwidth on the interface:

config system interface
    edit VL11
        set monitor-bandwidth enable
    next
end

Use the following commands to track the real-time data. For example, in the 'VL11' interface:

diagnose debug enable
diagnose debug traffic peek VL11 1

In the debug command above, 1 is used to enable debugging. Wait for 1-2 minutes to generate data.

diagnose debug traffic peek VL11 0    
diagnose debug disable

In the debug command above, 0 is used to disable debugging.

Example outputs:

In the example above:

1748511508: The timestamp. Use Epoch & Unix Timestamp Conversion Tools to convert the timestamp to May 29, 2025 16:38:28 (pm) / GMT+7. The (converted) timestamp needs to match the time shown in the bandwidth widget in the GUI.
82266857405232: The TX/Transmit data.
1794590813088: The RX/Receive data.

ACV-FW-01 (ACV-EFW) $
VL11: 1748511508 - ( 82266857405232, 1794590813088) 
...
VL11: 1748511624 - ( 82267472238280, 1794664392424)

The time from 1748511624 to 1748511508 is 116 seconds:

Tx: 81444965130112 - 81443202316424 = 614,833,048 bytes / 116 = 5,300,284.89 bit/s = 5,05 Mb/s.
Rx: 1794664392424 - 1794590813088 = 73,579,336 bytes / 116 = 634,304.62 bit/s = 0.605 Mb/s.

Note: If the Interface Bandwidth widget is not added to the FortiGate GUI Dashboard for the relevant interface, the debug command above will not display any output. To obtain the expected output, add the Interface Bandwidth widget to the GUI Dashboard and configure it for the correct interface.

At the same time, in the Firewall GUI, continuously collect the statistics of bandwidth on the 'VL11' interface.

Example outputs: From May 29, 2025, 16:38:28 (pm) to May 29, 2025, 16:40:24 (pm).

Collect the statistics of Inbound and Outbound bandwidth, then calculate the average data:

Outbound bandwidth is about 4.745 Mb/s and Inbound bandwidth is about 0.560 Mb/s.

Compare the calculated results in the two steps above, which show that the results in the Firewall GUI and CLI are about the same during the testing time.

Inbound bandwidth is about 0.56 Mb/s while Receive/Rx data is about 0.605 Mb/s.

Outbound bandwidth is about 4.745 Mb/s while Transmit/Tx data is about 0.56 Mb/s.

The Microsoft Excel file attached (traffic_peak_calculation_template.xlsx) can be used to calculate the interface bandwidth usage.

Procedure:

Extract the zip file traffic_peak_calculation_template.zip and open traffic_peak_calculation_template.xlsx.
Press the Alt key and highlight the EPOCH column on the Web CLI Console: right-click it, select Copy, and Paste it into the EPOCH column of the Microsoft Excel sheet 'traffic_peak_calculation_template.xlsx'.