Description
This article describes how to capture the traffic on FortiMail by using a sniffer command on the CLI or Traffic Capture on the GUI.
Solution
- Capture the traffic via CLI mode:
- Log the SSH session and output.
- Enable the logs for the other SSH clients (PuTTY, Secure CRT, Tera Term, MobaXterm…).
- Refer to the article in the field 'Related articles' to save the logs via PuTTY.
diagnose sniffer packet any ‘host 211.24.155.99 and port 25' 6 0 a <- Capture on any interface.
diagnose sniffer packet port1 ‘host 211.24.155.99 and port 25' 6 0 a <- Capture on interface port1.
Note: This is required for troubleshooting to send to the TAC team to convert to PCAP format.
- Capture the traffic from GUI: Go to System -> Utility-> Traffic Capture.
- Set the Interface to capture.
- Set the IP address of the SMTP host to capture.
- Set Protocol and port number to the filter.
- The capture will start running automatically after selecting Create.
Stop running the capture after getting the logs to utilize FortiMail performance. Export to PCAP format to investigate
