Is it possible to sniff for IP numbers that are _not_ in a list?

Forum|Forum|2 years ago
November 2, 2023
4 replies
3683 views

I have a list of < 300 IP numbers that I know about. We're not using DHCP, so there should be no addresses outside of those 300. I am really curious if there is any traffic going to IP numbers that I don't know about. If there is it could indicate something that is broken, or a hacker trying to discover something. This is obviously would work only on internal ports.

Any ideas?

FortiGate

Best answer by ebilcari

You can create an Address Group with all the known IPs you have in your subnet and create two firewall polices. On the first firewall policy allow access by specifying this group as Source. Clone the same rule and put it below and this time allow all the IP range for that subnet. On the second firewall policy enable "Log Allowed Traffic: All Sessions". This way you can verify if the second policy is used by any other IP (outside of the address group) and what traffic are they generating.

knagaraju

Staff

Hi tumming,

Could you please let me know if IP numbers means Protocol numbers ?

Sniffer command has options which are mentioned in the below link
https://docs.fortinet.com/document/fortigate/6.2.15/cookbook/680228/performing-a-sniffer-trace-cli-and-packet-capture

Please let me know if you have any additional queries.

Regards
Nagaraju.

tummingAuthor

Visitor III

No, I meant IP addresses. We call them IP numbers here. I had already rtfm'd and could not find an answer, hence my posting here.

tom

ebilcariAnswer

Staff

You can create an Address Group with all the known IPs you have in your subnet and create two firewall polices. On the first firewall policy allow access by specifying this group as Source. Clone the same rule and put it below and this time allow all the IP range for that subnet. On the second firewall policy enable "Log Allowed Traffic: All Sessions". This way you can verify if the second policy is used by any other IP (outside of the address group) and what traffic are they generating.

Emirjon

tummingAuthor

Visitor III

Yes! This looks like what I'm asking for. I already know how to create address groups from the command line, and I can write a simple script to automate creating the command. Then just cut'n paste into the cli. Easy peasy!

I'm going to run this by some other folks here first. If I mess up, I could break things badly.

Thanks for the answer, and actually reading the question! :)

tom

mle2802

Staff

Hi @tumming,

Do you mean IP address? If that, you can try this command "diag sniffer packet any "host X.X.X.X" 4 0 l" (replace X.X.X.X with your desired IP).

Regards,
Minh