How to sniff traffic using FortiOS GUI an...

FortiGate

FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.

Article Id 388225

Description

This article describes how to use FortiOS GUI sniffer advanced filters.

Scope

FortiGate.

Solution

To sniff traffic using FortiOS GUI, it is necessary to navigate to Network -> Diagnostics -> Packet capture, hit the button New packet capture, enable Filters, and hit the Advanced button.

Advanced filtering parameters should follow the same syntax as when running the 'diagnose sniffer packet' in the CLI (example: udp or tcp).

Putting the whole command (example: 'diagnose sniffer packet any "udp" 6 0 a or filters in quotes 'udp or tcp"/'udp or tcp') will return an error.

Example with Layer 3 Addresses:

The filter can be used with layer 3 addresses as well for filtered searches.

For a single destination and ICMP use: icmp and host 8.8.8.8
For multiple destinations and ICMP use: icmp and host 8.8.8.8 or host 1.1.1.1
For source and destination IPs with icmp use: icmp and host 8.8.8.8 and host 1.2.3.4

Note:

The advanced filters option is available only for Super Administrator profiles.

228

Broad. Integrated. Automated.

The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.

Technical Tip: How to sniff traffic using FortiOS GUI and advanced filters

You are leaving our website