Technical Tip: Troubleshooting FortiDDOS B/E dropped packet issues with one-armed sniffer on FortiGate

[arleniscg]

Description	This article describes how use FortiGate as a 'one-armed sniffer' for dropped packet capture.
Scope	FortiDDOS B/E.
Solution	FortiGate One-Arm Sniffer mode provides passive, out-of-band traffic capture, including dropped packets and enables advanced troubleshooting and security analysis without impacting production traffic. Server: root@172.30.153.27's password:  [root@Server ~]# cd /root/demo/be 1. while true; do ./run_non_stop_inbound_traffic.sh 1; sleep 1; done 2. while true; do tcpreplay -i eth1 --pps 20000 inbound_attack_traffic.pcap; done Notes: The script is generating non-stop inbound traffic. Tcpreplay sending a PCAP file at 20,000 packets per second on the eth1 interface.   Client:      root@172.30.153.26's password: fortinet [root@Client1 ~]# cd /root/mliu/be 1. while true; do ./run_non_stop_outbound_traffic.sh 1; sleep 1; done 2. while true; do tcpreplay -i eth1 --pps 20000 outbound_attack_traffic.pcap; done FortiGate: Network -> Interface. FortiDDoS: SPP-Default (prevention). Enable Dropped Packet Capture on the interface. 'One-armed sniffer' check: