convert "diag sniffer" to pcap: new tool

Forum|Forum|8 years ago
September 14, 2017
10 replies
41277 views

Hi,

I created a small program that helps firewall admins to create Wireshark comaptible pcap files on diskless Fortigate models. You can find the "fgsniffer" here on Github.

It works for me on Windows and Linux, now I need some testers!

Feedback is welcome.

Cheers,

Dirk

oheigl

New Member

Hi Dirk,

I just tried it with a trace I took yesterday, and it doesn't seem to work. There is only one packet (should be 259) and Wireshark tells me that the FCS is incorrect. No other packets are listed.

I appreciate the work you put into this, but why don't you use the compiled version linked in this KB: http://kb.fortinet.com/kb/documentLink.do?externalID=FD30877

Did it not work for you?

Kind regards

DirkDuesentriebAuthor

New Member

I tried only the original perl and this created only empty output or errors depending on the perl version. The compiled version works (on Windows) and produces a valid pcap file. Still the times are not considering the time zone, they are off by two for me.

Can you provide one ore two packets of your test capture, that didn't match? I think my regex doesn't match, because of some little difference. I'd like to fix that.

Cheers,

Dirk

oheigl

New Member

Yeah I usually fix the time zone problem with Wireshark and Time Shift. I sent you a PM, hope the formatting is somewhat correct, otherwise just tell me