NOTE: FortiNAC is now named FortiNAC-F. For post-9.4 articles, see FortiNAC-F. FortiNAC is a zero-trust network access solution that provides users with enhanced visibility into the Internet of Things (IoT) devices on their enterprise networks.
This article describes how to perform long-term packet capture with the output in multiple, separate files instead of capturing traffic into one enormous PCAP file.
Scope
FortiNAC v9.4.X.
Solution
Open SSH to a FortiNAC, and execute the command below:
tcpdump -W 20 -C 20 -w Capture.pcap
Where '-W' filecount (20 files will be created), '-C' file_size (each maximum 20 MB), '-w' file_name (Capture.pcap). This instruction allows to capture of a new file once the file size reaches the option value. Output could be:
