This article describes how to display the list of current running packet captures.
Note that running packet captures or sniffers issued through CLI (applet or SSH connection) cannot be displayed.
FortiOS.
FortiOS can display/start/stop/remove captured data, for the current packet captures with the following commands:
diagnose on-demand-sniffer list
diagnose on-demand-sniffer start <name>
diagnose on-demand-sniffer stop <name>
diagnose on-demand-sniffer delete-results <name>
Usage shown below:
Related documents:
Troubleshooting Tip: Packet Capture on FortiOS GUI
Embed real-time packet capture and analysis tool on Diagnostics page
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2025 Fortinet, Inc. All Rights Reserved.