Fortinet Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
ds_warwick
New Contributor

Packet Capture on Fortigate Firewall not capturing all packets

We have a Fortigate 200D running the 5.0 firmware.

When I use the Packet Capture, I notice some odd behaviour that I do not understand and wanted to know if this is normal or is there a problem.

 

I select the Packet Capture option via the GUI. System > Network > Packet Capture

I create a new packet capture and select my criteria. Sometimes I filter certain hosts and then start the capture.

 

When I attempt to generate some traffic to one of the hosts in the capture criteria, I do not see all of the packets. Particular examples include the following:

[ol]
  • I generate a continuous ping to a host, the packet capture captures the first two ICMP requests and responses but doesn't capture anymore than that, even though the ping is still running in the background.
  • I SSH to one of my hosts, the packet capture gets the first few packets (the three-way handshake) and maybe one or two more but then fails to capture any of the rest of the packets.[/ol]

    I should point out that the firewall is a termination point for an IPSEC VPN tunnel and represents the far end of the link.

    In the diagram below, I'm trying to capture packets between the Remote LAN and the Fortigate 20D on an interface called "user_vlan" which represents the subnet of the Remote LAN.

     

     <Me><Local LAN><Fortigate> <IPSEC VPN> <Fortigate 20D><Remote LAN "user_vlan">

     

    Connectivity is all fine and working, I just don't understand why the packet capture doesn't capture ALL of the packets I expect it to.

     

    Darren.

  • 1 Solution
    jintrah_FTNT
    Staff
    Staff

    Hello,

     

    This is expected when you have hardware acceleration in place.......... only the initial handshake is seen, rest of the traffic is offloaded to ASIC, and does not reach the CPU. Please see the below KB

    http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD30043

    http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD36466

     

    Regards

    View solution in original post

    2 REPLIES 2
    jintrah_FTNT
    Staff
    Staff

    Hello,

     

    This is expected when you have hardware acceleration in place.......... only the initial handshake is seen, rest of the traffic is offloaded to ASIC, and does not reach the CPU. Please see the below KB

    http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD30043

    http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD36466

     

    Regards

    ds_warwick

    Thanks for the very quick reply. I think this is probably what is happening. I will try out the commands.