Skip to main content
ds_warwick
ds_warwick
New Member
September 23, 2015
Solved

Packet Capture on Fortigate Firewall not capturing all packets

  • September 23, 2015
  • 1 reply
  • 17957 views

We have a Fortigate 200D running the 5.0 firmware.

When I use the Packet Capture, I notice some odd behaviour that I do not understand and wanted to know if this is normal or is there a problem.

 

I select the Packet Capture option via the GUI. System > Network > Packet Capture

I create a new packet capture and select my criteria. Sometimes I filter certain hosts and then start the capture.

 

When I attempt to generate some traffic to one of the hosts in the capture criteria, I do not see all of the packets. Particular examples include the following:

[ol]
  • I generate a continuous ping to a host, the packet capture captures the first two ICMP requests and responses but doesn't capture anymore than that, even though the ping is still running in the background.
  • I SSH to one of my hosts, the packet capture gets the first few packets (the three-way handshake) and maybe one or two more but then fails to capture any of the rest of the packets.[/ol]

    I should point out that the firewall is a termination point for an IPSEC VPN tunnel and represents the far end of the link.

    In the diagram below, I'm trying to capture packets between the Remote LAN and the Fortigate 20D on an interface called "user_vlan" which represents the subnet of the Remote LAN.

     

     <Me><Local LAN><Fortigate> <IPSEC VPN> <Fortigate 20D><Remote LAN "user_vlan">

     

    Connectivity is all fine and working, I just don't understand why the packet capture doesn't capture ALL of the packets I expect it to.

     

    Darren.

    • Best answer by jintrah_FTNT

    Hello,

     

    This is expected when you have hardware acceleration in place.......... only the initial handshake is seen, rest of the traffic is offloaded to ASIC, and does not reach the CPU. Please see the below KB

    http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD30043

    http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD36466

     

    Regards

    1 reply

    jintrah_FTNT
    Staff
    jintrah_FTNTAnswer
    Staff
    September 23, 2015

    Hello,

     

    This is expected when you have hardware acceleration in place.......... only the initial handshake is seen, rest of the traffic is offloaded to ASIC, and does not reach the CPU. Please see the below KB

    http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD30043

    http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD36466

     

    Regards

    ds_warwick
    ds_warwickAuthor
    New Member
    September 23, 2015

    Thanks for the very quick reply. I think this is probably what is happening. I will try out the commands.

     

     

    Terms & ConditionsCookie settingsAccessibility statement