Technical Tip: Wireshark showing 'Bogus IPv4 version (5, must be 4)' for FortiGate Heartbeat packet

Description

This article describes the solution to view heartbeat packet capture correctly in Wireshark.

Investigation into the heartbeat packet is usually done by issuing the following command:

diagnost sniffer packet any 'ether proto 0x8890' 6 0 l

Once converted, the file can be opened in Wireshark for further investigation. However, Wireshark will show an error with IPv4 version and mark it as Bogus:

Scope

 FortiGate.

Solution

This issue is due to the decode method on Wireshark.

To resolve this issue, navigate to Analyze on the toolbar menu and select Decode As:

In the pop-up window, ensure the option Field is selected as Ethertype and the option for Current is set to fortient_fgcp_hb:

The output for the heartbeat packet will show up correctly: