New Member

Question

Can t ping from my host client to internet via fortinet Firewall

Forum|Forum|2 years ago
August 1, 2023
4 replies
9141 views

Hello, Can you help me please I have a correct static routes and policies that enable the traffic to access internet my firewall can access internet when I ping 8.8.8.8 but the host client that is in the same network as the lan of the firewall and has as a gateway the Ip of the Lan can t ping to the internet I get request time out, I have policies of outbound that enable all traffic from Lan to wan

FortiOS-VM64 # config firewall policy

FortiOS-VM64 (policy) # edit 3

FortiOS-VM64 (3) # show
config firewall policy
edit 3
set name "Lan to wan"
set uuid 161ce1d2-2fa9-51ee-1c02-94434bc9f1d1
set srcintf "port5"
set dstintf "port1"
set action accept
set srcaddr "LAN"
set dstaddr "all"
set schedule "always"
set service "ALL"
set log traffic all
set Nat enable
next
end

, and static route
FortiOS-VM64 (2) # show
config router static
edit 2
set gateway 192.168.10.1
set device "port1"
next
end
port1 is the wan and port2 in the Lan here are my interfaces
FortiOS-VM64 (interface) # show
config system interface
edit "mgmt"
set vdom "root"
set allow access ping https ssh fgfm
set status down
set type physical
set dedicated-to management
set snmp-index 1
next
edit "port1"
set vdom "root"
set ip 192.168.10.100 255.255.255.0
set allowaccess ping https ssh http
set type physical
set alias "wan"
set lldp-reception enable
set role wan
set snmp-index 2
next

edit "port5"
set vdom "root"
set ip 2.2.2.2 255.255.255.0
set allowaccess ping https ssh http fgfm
set type physical
set alias "LAN"
set lldp-transmission enable
set role lan
set snmp-index 6 , thank you

FortiGate

npariyar

Staff

Let's suppose you want to ping 8.8.8.8 from the host and the host IP is 2.2.2.5.

Do a continuous ping to 8.8.8.8 from 2.2.2.5 then capture the following logs:

CLI 1:

diagnose sniffer packet any 'host 8.8.8.8 and host 2.2.2.5 and icmp' 4 0 a

CLI 2:

diagnose debug flow filter saddr 2.2.2.5
diagnose debug flow filter daddr 8.8.8.8
diagnose debug flow filter proto 1
diagnose debug flow show function-name
diagnose debug console timestamp enable
diagnose debug flow trace start 1000
diagnose debug enable

After collecting the logs, disable logging by:

diagnose debug disable
diagnose debug flow filter clear
diagnose debug reset

Share us the logs

SALMABSTAuthor

New Member

FortiOS-VM64 # diagnose sniffer packet any 'host 8.8.8.8 and host 2.2.2.10 and icmp' 4 0 a
Using Original Sniffing Mode
interfaces=[any]
filters=[host 8.8.8.8 and host 2.2.2.10 and icmp]
2023-08-07 13:55:24.492527 port5 in 2.2.2.10 -> 8.8.8.8: icmp: echo request
2023-08-07 13:55:29.333920 port5 in 2.2.2.10 -> 8.8.8.8: icmp: echo request
2023-08-07 13:55:34.335090 port5 in 2.2.2.10 -> 8.8.8.8: icmp: echo request
2023-08-07 13:55:39.318743 port5 in 2.2.2.10 -> 8.8.8.8: icmp: echo request
^C
4 packets received by filter
0 packets dropped by kernel

FortiOS-VM64 # diagnose debug flow filter saddr 2.2.2.10

FortiOS-VM64 # diagnose debug flow filter daddr 8.8.8.8

FortiOS-VM64 # diagnose debug flow filter proto 1

FortiOS-VM64 # diagnose debug flow show function-name
show function name

FortiOS-VM64 # diagnose debug console timestamp enable

FortiOS-VM64 # diagnose debug flow trace start 1000

FortiOS-VM64 # diagnose debug enable

FortiOS-VM64 # 2023-08-07 06:59:10 id=65308 trace_id=1 func=print_pkt_detail line=5842 msg="vd-root:0 received a p
acket(proto=1, 2.2.2.10:1->8.8.8.8:2048) tun_id=0.0.0.0 from port5. type=8, code=0, id=1, seq=76."
2023-08-07 06:59:10 id=65308 trace_id=1 func=init_ip_session_common line=6028 msg="allocate a new session-0000032a
, tun_id=0.0.0.0"
2023-08-07 06:59:10 id=65308 trace_id=1 func=__vf_ip_route_input_rcu line=2012 msg="find a route: flag=00000000 gw
-192.168.10.1 via port1"
2023-08-07 06:59:14 id=65308 trace_id=2 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=1,
2.2.2.10:1->8.8.8.8:2048) tun_id=0.0.0.0 from port5. type=8, code=0, id=1, seq=77."
2023-08-07 06:59:14 id=65308 trace_id=2 func=init_ip_session_common line=6028 msg="allocate a new session-0000032f
, tun_id=0.0.0.0"
2023-08-07 06:59:14 id=65308 trace_id=2 func=__vf_ip_route_input_rcu line=2012 msg="find a route: flag=00000000 gw
-192.168.10.1 via port1"
2023-08-07 06:59:19 id=65308 trace_id=

@npariyar wrote:
Let's suppose you want to ping 8.8.8.8 from the host and the host IP is 2.2.2.5.
Do a continuous ping to 8.8.8.8 from 2.2.2.5 then capture the following logs:

CLI 1:
diagnose sniffer packet any 'host 8.8.8.8 and host 2.2.2.5 and icmp' 4 0 a

CLI 2:
diagnose debug flow filter saddr 2.2.2.5
diagnose debug flow filter daddr 8.8.8.8
diagnose debug flow filter proto 1
diagnose debug flow show function-name
diagnose debug console timestamp enable
diagnose debug flow trace start 1000
diagnose debug enable

After collecting the logs, disable logging by:
diagnose debug disable
diagnose debug flow filter clear
diagnose debug reset

Share us the logs

3 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=1,
2.2.2.10:1->8.8.8.8:2048) tun_id=0.0.0.0 from port5. type=8, code=0, id=1, seq=78."
2023-08-07 06:59:19 id=65308 trace_id=3 func=init_ip_session_common line=6028 msg="allocate a new session-00000334
, tun_id=0.0.0.0"

seshuganesh

Staff

Hi Team,

As per the debug seems like we are not offloading session out of the firewall. This could happen if there is any ISP issue:

Could you please ping to ISP gateway from the firewall, see if we are pinging or not.

If we are not able to ping, please execute this command:

diag sniffer packet any 'host <ISP-GW>' 4 0 a

After executing the above command, please ping to ISP gateway in another console and share us the result

FortiNitish

Staff

You need to check if the traffic is hitting the firewall interface first.

You can check that by running a packet capture using the source IP of the host

diag sniffer packet any 'host x.x.x.x' 4 0 a ( x.x.x.x is the source IP of the host machine in your LAN network)

I could see that 2.2.2.5 is the IP you have mentioned as the source IP, I would request you to check the IP once again as it is public IP. Please ensure the host machine is in the lan network.

FortiNitish

Staff

You need to check if the traffic is hitting the firewall interface first.

You can check that by running a packet capture using the source IP of the host

diag sniffer packet any 'host x.x.x.x' 4 0 a ( x.x.x.x is the source IP of the host machine in your LAN network)

I could see that 2.2.2.2 is the IP you have mentioned as the source interface IP, I would request you to check the IP once again as it is public IP. Please ensure the host machine is in the Lan network.

SALMABSTAuthor

New Member

FortiOS-VM64 # diagnose sniffer packet any 'host 8.8.8.8 and host 2.2.2.10 and icmp' 4 0 a
Using Original Sniffing Mode
interfaces=[any]
filters=[host 8.8.8.8 and host 2.2.2.10 and icmp]
2023-08-07 13:55:24.492527 port5 in 2.2.2.10 -> 8.8.8.8: icmp: echo request
2023-08-07 13:55:29.333920 port5 in 2.2.2.10 -> 8.8.8.8: icmp: echo request
2023-08-07 13:55:34.335090 port5 in 2.2.2.10 -> 8.8.8.8: icmp: echo request
2023-08-07 13:55:39.318743 port5 in 2.2.2.10 -> 8.8.8.8: icmp: echo request
^C
4 packets received by filter
0 packets dropped by kernel

FortiOS-VM64 # diagnose debug flow filter saddr 2.2.2.10

FortiOS-VM64 # diagnose debug flow filter daddr 8.8.8.8

FortiOS-VM64 # diagnose debug flow filter proto 1

FortiOS-VM64 # diagnose debug flow show function-name
show function name

FortiOS-VM64 # diagnose debug console timestamp enable

FortiOS-VM64 # diagnose debug flow trace start 1000

FortiOS-VM64 # diagnose debug enable

FortiOS-VM64 # 2023-08-07 06:59:10 id=65308 trace_id=1 func=print_pkt_detail line=5842 msg="vd-root:0 received a p
acket(proto=1, 2.2.2.10:1->8.8.8.8:2048) tun_id=0.0.0.0 from port5. type=8, code=0, id=1, seq=76."
2023-08-07 06:59:10 id=65308 trace_id=1 func=init_ip_session_common line=6028 msg="allocate a new session-0000032a
, tun_id=0.0.0.0"
2023-08-07 06:59:10 id=65308 trace_id=1 func=__vf_ip_route_input_rcu line=2012 msg="find a route: flag=00000000 gw
-192.168.10.1 via port1"
2023-08-07 06:59:14 id=65308 trace_id=2 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=1,
2.2.2.10:1->8.8.8.8:2048) tun_id=0.0.0.0 from port5. type=8, code=0, id=1, seq=77."
2023-08-07 06:59:14 id=65308 trace_id=2 func=init_ip_session_common line=6028 msg="allocate a new session-0000032f
, tun_id=0.0.0.0"
2023-08-07 06:59:14 id=65308 trace_id=2 func=__vf_ip_route_input_rcu line=2012 msg="find a route: flag=00000000 gw
-192.168.10.1 via port1"
2023-08-07 06:59:19 id=65308 trace_id=3 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=1,
2.2.2.10:1->8.8.8.8:2048) tun_id=0.0.0.0 from port5. type=8, code=0, id=1, seq=78."
2023-08-07 06:59:19 id=65308 trace_id=3 func=init_ip_session_common line=6028 msg="allocate a new session-00000334
, tun_id=0.0.0.0"

msanjaypadma

Staff

Hi @SALMABST ,

From above shared logs, we can understand only ICMP echo request packet is coming in

"port5 in 2.2.2.10 -> 8.8.8.8: icmp: echo request"

Since NAT is enabled, we will not able to confirm from above packet capture , is that packet going out or not.
And in debug logs as well, not able to see policy lookup.

Try to run below packet capture and debug and could you please share the logs again.

SSH 1:
get router info routing detail <destination>
get router info routing detail <source>

diag debug reset
diag debug disable
diag debug flow filter clear
diag debug flow filter addr x.x.x.x <--- IP address of the destination
diag debug flow show iprope enable
diag debug flow show function-name enable
diag debug console timestamp enable
diag debug flow trace start 9999
diag debug enable

SSH 2:
diag sniffer packet any “host y.y.y.y “ 6 0 l <<<<<<<where y.y.y.y is destination ip address

And now try to initiate ping request from PC.

Once logs generated now stop all traffic on user PC.

Thanks,

SALMABSTAuthor

New Member

FortiOS-VM64 # get router info routing detail 8.8.8.8

Routing table for VRF=0
Routing entry for 0.0.0.0/0
Known via "static", distance 5, metric 0, best
* vrf 0 172.20.10.1, via port1

Routing entry for 0.0.0.0/0
Known via "static", distance 10, metric 0
directly connected, port1

FortiOS-VM64 # get router info routing detail 2.2.2.10

Routing table for VRF=0
Routing entry for 2.2.2.0/24
Known via "connected", distance 0, metric 0, best
* is directly connected, port5

FortiOS-VM64 # diag debug reset

FortiOS-VM64 # diag debug disable

FortiOS-VM64 # diag debug flow filter clear

FortiOS-VM64 # diag debug flow filter addr
Host addr: any

FortiOS-VM64 # diag debug flow filter addr 8.8.8.8

FortiOS-VM64 # diag debug flow show iprope enable
show trace messages about iprope

FortiOS-VM64 # diag debug flow show function-name enable
show function name

FortiOS-VM64 # diag debug console timestamp enable

FortiOS-VM64 # diag debug flow trace start 9999

FortiOS-VM64 # diag debug enable

FortiOS-VM64 # 2023-08-08 02:59:28 id=65308 trace_id=151 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=6, 172.20.10.2:6664->8.8.8.8:853) tun_id=0.0.0.0 from local. flag [S], seq 3866561924, ack 0, win 29200"
2023-08-08 02:59:28 id=65308 trace_id=151 func=init_ip_session_common line=6028 msg="allocate a new session-0000029d, tun_id=0.0.0.0"
2023-08-08 02:59:28 id=65308 trace_id=151 func=iprope_dnat_check line=5303 msg="in-[], out-[port1]"
2023-08-08 02:59:28 id=65308 trace_id=151 func=iprope_dnat_tree_check line=824 msg="len=0"
2023-08-08 02:59:28 id=65308 trace_id=151 func=iprope_dnat_check line=5315 msg="result: skb_flags-00000000, vid-0, ret-no-match, act-accept, flag-00000000"
2023-08-08 02:59:28 id=65308 trace_id=151 func=__iprope_check line=2307 msg="gnum-100004, check-000000004722e5a4"
2023-08-08 02:59:28 id=65308 trace_id=151 func=__iprope_check_one_policy line=2059 msg="checked gnum-100004 policy-3, ret-no-match, act-drop"
2023-08-08 02:59:28 id=65308 trace_id=151 func=__iprope_check_one_policy line=2059 msg="checked gnum-100004 policy-0, ret-no-match, act-drop"
2023-08-08 02:59:28 id=65308 trace_id=151 func=__iprope_check line=2324 msg="gnum-100004 check result: ret-no-match, act-drop, flag-00000000, flag2-00000000"
2023-08-08 02:59:28 id=65308 trace_id=151 func=iprope_policy_group_check line=4730 msg="after check: ret-no-match, act-drop, flag-00000000, flag2-00000000"
2023-08-08 02:59:28 id=65308 trace_id=151 func=ip_session_confirm_final line=3087 msg="npu_state=0x0, hook=4"
2023-08-08 02:59:28 id=65308 trace_id=152 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=6, 8.8.8.8:853->172.20.10.2:6664) tun_id=0.0.0.0 from port1. flag [S.], seq 1078350162, ack 3866561925, win 65535"
2023-08-08 02:59:28 id=65308 trace_id=152 func=resolve_ip_tuple_fast line=5930 msg="Find an existing session, id-0000029d, reply direction"
2023-08-08 02:59:28 id=65308 trace_id=152 func=__vf_ip_route_input_rcu line=2012 msg="find a route: flag=80000000 gw-0.0.0.0 via root"
2023-08-08 02:59:28 id=65308 trace_id=153 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=6, 172.20.10.2:6664->8.8.8.8:853) tun_id=0.0.0.0 from local. flag [.], seq 3866561925, ack 1078350163, win 2"
2023-08-08 02:59:28 id=65308 trace_id=153 func=resolve_ip_tuple_fast line=5930 msg="Find an existing session, id-0000029d, original direction"
2023-08-08 02:59:28 id=65308 trace_id=154 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=6, 172.20.10.2:6664->8.8.8.8:853) tun_id=0.0.0.0 from local. flag [.], seq 3866561925, ack 1078350163, win 2"
2023-08-08 02:59:28 id=65308 trace_id=154 func=resolve_ip_tuple_fast line=5930 msg="Find an existing session, id-0000029d, original direction"
2023-08-08 02:59:28 id=65308 trace_id=155 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=6, 8.8.8.8:853->172.20.10.2:6664) tun_id=0.0.0.0 from port1. flag [.], seq 1078350163, ack 3866562380, win 261"
2023-08-08 02:59:28 id=65308 trace_id=155 func=resolve_ip_tuple_fast line=5930 msg="Find an existing session, id-0000029d, reply direction"
2023-08-08 02:59:28 id=65308 trace_id=156 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=6, 8.8.8.8:853->172.20.10.2:6664) tun_id=0.0.0.0 from port1. flag [.], seq 1078350163, ack 3866562380, win 261"
2023-08-08 02:59:28 id=65308 trace_id=156 func=resolve_ip_tuple_fast line=5930 msg="Find an existing session, id-0000029d, reply direction"
2023-08-08 02:59:28 id=65308 trace_id=157 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=6, 172.20.10.2:6664->8.8.8.8:853) tun_id=0.0.0.0 from local. flag [.], seq 3866562380, ack 1078351551, win 2"
2023-08-08 02:59:28 id=65308 trace_id=157 func=resolve_ip_tuple_fast line=5930 msg="Find an existing session, id-0000029d, original direction"
2023-08-08 02:59:28 id=65308 trace_id=158 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=6, 8.8.8.8:853->172.20.10.2:6664) tun_id=0.0.0.0 from port1. flag [.], seq 1078351551, ack 3866562380, win 261"
2023-08-08 02:59:28 id=65308 trace_id=158 func=resolve_ip_tuple_fast line=5930 msg="Find an existing session, id-0000029d, reply direction"
2023-08-08 02:59:28 id=65308 trace_id=159 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=6, 172.20.10.2:6664->8.8.8.8:853) tun_id=0.0.0.0 from local. flag [.], seq 3866562380, ack 1078352939, win 3"
2023-08-08 02:59:28 id=65308 trace_id=159 func=resolve_ip_tuple_fast line=5930 msg="Find an existing session, id-0000029d, original direction"
2023-08-08 02:59:28 id=65308 trace_id=160 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=6, 8.8.8.8:853->172.20.10.2:6664) tun_id=0.0.0.0 from port1. flag [.], seq 1078352939, ack 3866562380, win 261"
2023-08-08 02:59:28 id=65308 trace_id=160 func=resolve_ip_tuple_fast line=5930 msg="Find an existing session, id-0000029d, reply direction"
2023-08-08 02:59:28 id=65308 trace_id=161 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=6, 172.20.10.2:6664->8.8.8.8:853) tun_id=0.0.0.0 from local. flag [.], seq 3866562380, ack 1078354327, win 3"
2023-08-08 02:59:28 id=65308 trace_id=161 func=resolve_ip_tuple_fast line=5930 msg="Find an existing session, id-0000029d, original direction"
2023-08-08 02:59:28 id=65308 trace_id=162 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=6, 8.8.8.8:853->172.20.10.2:6664) tun_id=0.0.0.0 from port1. flag [.], seq 1078354327, ack 3866562380, win 261"
2023-08-08 02:59:28 id=65308 trace_id=162 func=resolve_ip_tuple_fast line=5930 msg="Find an existing session, id-0000029d, reply direction"
2023-08-08 02:59:28 id=65308 trace_id=163 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=6, 172.20.10.2:6664->8.8.8.8:853) tun_id=0.0.0.0 from local. flag [.], seq 3866562380, ack 1078354973, win 3"
2023-08-08 02:59:28 id=65308 trace_id=163 func=resolve_ip_tuple_fast line=5930 msg="Find an existing session, id-0000029d, original direction"
2023-08-08 02:59:28 id=65308 trace_id=164 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=6, 172.20.10.2:6664->8.8.8.8:853) tun_id=0.0.0.0 from local. flag [.], seq 3866562380, ack 1078354973, win 3"
2023-08-08 02:59:28 id=65308 trace_id=164 func=resolve_ip_tuple_fast line=5930 msg="Find an existing session, id-0000029d, original direction"
2023-08-08 02:59:28 id=65308 trace_id=165 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=6, 172.20.10.2:6664->8.8.8.8:853) tun_id=0.0.0.0 from local. flag [F.], seq 3866562404, ack 1078354973, win 3"
2023-08-08 02:59:29 id=65308 trace_id=165 func=resolve_ip_tuple_fast line=5930 msg="Find an existing session, id-0000029d, original direction"
2023-08-08 02:59:29 id=65308 trace_id=166 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=6, 8.8.8.8:853->172.20.10.2:6664) tun_id=0.0.0.0 from port1. flag [F.], seq 1078354973, ack 3866562405, win 261"
2023-08-08 02:59:29 id=65308 trace_id=166 func=resolve_ip_tuple_fast line=5930 msg="Find an existing session, id-0000029d, reply direction"
2023-08-08 02:59:29 id=65308 trace_id=167 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=6, 172.20.10.2:6664->8.8.8.8:853) tun_id=0.0.0.0 from local. flag [.], seq 3866562405, ack 1078354974, win 3"
2023-08-08 02:59:29 id=65308 trace_id=167 func=resolve_ip_tuple_fast line=5930 msg="Find an existing session, id-0000029d, original direction"
2023-08-08 03:00:27 id=65308 trace_id=168 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=17, 2.2.2.10:53368->8.8.8.8:53) tun_id=0.0.0.0 from port5. "
2023-08-08 03:00:27 id=65308 trace_id=168 func=init_ip_session_common line=6028 msg="allocate a new session-000002a8, tun_id=0.0.0.0"
2023-08-08 03:00:27 id=65308 trace_id=168 func=iprope_dnat_check line=5303 msg="in-[port5], out-[]"
2023-08-08 03:00:27 id=65308 trace_id=168 func=iprope_dnat_tree_check line=824 msg="len=0"
2023-08-08 03:00:27 id=65308 trace_id=168 func=iprope_dnat_check line=5315 msg="result: skb_flags-02000000, vid-0, ret-no-match, act-accept, flag-00000000"
2023-08-08 03:00:27 id=65308 trace_id=168 func=__vf_ip_route_input_rcu line=2012 msg="find a route: flag=00000000 gw-172.20.10.1 via port1"
2023-08-08 03:00:28 id=65308 trace_id=169 func=print_pkt_detail line=5842 msg="vd-root:0 received a packet(proto=17, 2.2.2.10:53368->8.8.8.8:53) tun_id=0.0.0.0 from port5. "
2023-08-08 03:00:28 id=65308 trace_id=169 func=init_ip_session_common line=6028 msg="allocate a new session-000002a9, tun_id=0.0.0.0"
2023-08-08 03:00:28 id=65308 trace_id=169 func=iprope_dnat_check line=5303 msg="in-[port5], out-[]"
2023-08-08 03:00:28 id=65308 trace_id=169 func=iprope_dnat_tree_check line=824 msg="len=0"
2023-08-08 03:00:28 id=65308 trace_id=169 func=iprope_dnat_check line=5315 msg="result: skb_flags-02000000, vid-0, ret-no-match, act-accept, flag-00000000"
2023-08-08 03:00:28 id=65308 trace_id=169 func=__vf_ip_route_input_rcu line=2012 msg="find a route: flag=00000000 gw-172.20.10.1 via port1"

FortiOS-VM64 # diag sniffer packet any "host 8.8.8.8" 6 0 l
Using Original Sniffing Mode
interfaces=[any]
filters=[host 8.8.8.8]
2023-08-08 02:53:56.930393 port5 in 2.2.2.10 -> 8.8.8.8: icmp: echo request
0x0000 0000 0000 0001 000c 297a e0bc 0800 4500 ........)z....E.
0x0010 003c 06a0 0000 8001 2006 0202 020a 0808 .<..............
0x0020 0808 0800 4d5a 0001 0001 6162 6364 6566 ....MZ....abcdef
0x0030 6768 696a 6b6c 6d6e 6f70 7172 7374 7576 ghijklmnopqrstuv
0x0040 7761 6263 6465 6667 6869 wabcdefghi

2023-08-08 02:54:01.527099 port5 in 2.2.2.10 -> 8.8.8.8: icmp: echo request
0x0000 0000 0000 0001 000c 297a e0bc 0800 4500 ........)z....E.
0x0010 003c 06a1 0000 8001 2005 0202 020a 0808 .<..............
0x0020 0808 0800 4d59 0001 0002 6162 6364 6566 ....MY....abcdef
0x0030 6768 696a 6b6c 6d6e 6f70 7172 7374 7576 ghijklmnopqrstuv
0x0040 7761 6263 6465 6667 6869 wabcdefghi

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded