Defining FortiGate Services

[John_Stoker]

Can anyone help me with the definitions of the services that run on the FortiGates? I think this would be highly helpful to those of us who are watching high memory or cpu utilization on a specific service but cannot correlate it to anything. Specifically I' m trying to figure out what the " scanunitd" service is/does. Here' s a partial list of the services I have seen, some of them are obviously self-explanatory: Self-Explanatory: thttp.........................http daemon ipsengine......................... ips engine hasync......................... ha sync service pop3......................... pop3 service smtp ......................... smtp service cli .........................cli service hatalk ......................... ha talk service httpsd .........................https daemon sshd .........................ssh daemon authd .........................authentication daemon alertmail .........................mail alerts urlfilter .........................url filter bgpd .........................bgp routing daemon ospfd .........................ospf routing daemon zebos_laun .........................zebos routing daemon ripd .........................rip routing daemon updated .........................av/ip spam/web filter update service snmpd .........................snmp daemon ftpd .........................ftp daemon imapd .........................imap daemon newcli .........................creates new cli session (?) chassis500 .........................chassis daemon quard .........................quaranine daemon nntpd .........................nntp daemon telnetd .........................telnet daemon ipsmonitor .........................ips monitor (?) pimd .........................pim/multicast daemon proxyd .........................proxy daemon imd .........................IM daemon Ambiguous: scanunitd.........................? miglogd.........................? forticron.........................? merged_dae.........................? init.........................? getty.........................? imi.........................? pdmd.........................? nsm.........................? cmbdsvr.........................? Please take the list and add or make changes where you deem necessary, thanks guys and gals!

[TopJimmy]

Did anybody ever figure out what the processes definitions are?

[#3]

" scanunitd"

This daemon is responsible for much of the functionality of the threat management system. 1. First level parsing of incoming data 2. Invokes anti-virus engine 3. Decompress/unpack files 4. Determines banned words matching 5. Determines file pattern matching 6. Determines quarantine matching 7. Virus checksum value checking 8. Invokes antispam engine Basically the glue for preparation of many of the inspection engines.

[rwpatterson]

I believe getty is a throwback from Unix/Linux. Google it... Has to do with the CLI interface. (tty) From Wikipedia:

getty short for " get teletype" , is a Unix program running on a host computer that manages physical or virtual terminals (tty). When it detects a connection, it prompts for a username and runs the ' login' program to authenticate the user. Originally, on traditional Unix systems, getty handled connections to serial terminals (often teletype machines) connected to a host computer. The ' tty' part of the name stands for teletype, but has come to mean any type of text terminal. One getty process serves one terminal. In some systems, for example Solaris, getty was replaced by ttymon. Personal computers running Unix-like operating systems, even if they do not provide any remote login services, may still use getty as a means of logging in on a local virtual console. Instead of the ' login' program getty may also be set up by the system administrator to run any other program, for example a PPP daemon to provide dial-up Internet access.

[abelio]

funny thread. not so exhaustive as fuhrimans (thanks man):

miglogd.........................?

is the log daemon.

forticron.........................?

i guess that it does what its name implies: it' s in charge of all scheduled tasks

nsm.........................?

i guess that it is related with ospf nsm stuff

[mramon79]

Hi,

• initXXXXXXXXXXX (its job is to start other processes) • zebos_launcher (zebos launcher daemon) • hp_api (hp api) • cmdbsvr (cmdb server - update processes / configuration) • uploadd (upload daemon) • adsl2plus (adsl2plus daemon) • sqldb (sqldb) • reportd (report daemon) • sql_logd (sql log daemon) • miglogd (log daemon) • chlbd (chassis loadbalance daemon) • haocd (content cluster HA over chassis daemon) • kmiglogd (kernel log daemon) • httpsd (https daemon) • pyfcgid (python config daemon) • sslvpnd (ssl vpn) • info_sslvpnd (ssl vpn info daemon) • smbcd (smb client daemon) • lcdapp (Control the LCD panel) • proxyd (proxy daemon) • imd (IM proxy daemon) • wad_launcher (wan acceleration proxy) • wad (explicit proxy, mapi rpc) • wad_diskd (wan acceleration disk daemon) • dlpfingerprint (dlp fingerprint daemon) • dlpfpcache (dlp fingerprint cache daemon) • scanunitd (scanunit daemon) • getty (wait for console/telnet connection) • mingetty tty1 (mingetty tty1 daemon) • mingetty tty2 (mingetty tty2 daemon) • iked (ike daemon) • nids_monitor_name (ips monitor daemon) • updated (update daemon <= to init some shared memory segment used by other executables) • merged_daemons (merge daemon - should be split in future. There is a mantics.) • fclicense (FC license daemon) • amc_monitor (AMC monitor daemon) • forticron (crl update daemon) • bypass_monitor (bypass monitor daemon) • chassis5000d (chassis 5000 daemon) • chassisd 192.168.127.254 (chassis daemon) • fdsmgmtd (fortiguard management daemon) • fds_msg (fds message daemon) • snmpd (snmp) • dhcpd (dhcp server) • dhcpcd (dhcp client) • dhcprd (dhcp relay) • hatalk (ha protocol module) • haysnc (ha synchronization module) • harelay (ha relay module for tcp) • pptpd (pptp) • l2tpd (l2tp) • ipldbd (ipldbd daemon) • vsd (virtual server daemon) • acd (aggregate controller daemon) • src-vis (source visibility daemon) • pppoed (pppoe daemon) • ddnscd (ddns client daemon) • urlfilter (URL filter daemon) • ntpd (ntp server daemon) • sshd (ssh daemon) • tftpd (tftp daemon) • telnetd (telnet daemon) • authd (authenticated daemon) • fssod (fsso daemon) • quard (quarantine daemon) • rtmon (ping server) • radvd (router adv daemon) • alertemail (alertemail daemon) • dnsproxy (dns proxy daemon) • sflowd (sflow protocol daemon) • nat64d (NAT64 daemon) • radiusd (radius daemon) • notifd (notification daemon = carrier only) • gtpgkd (gtp daemon = carrier only) • mass_mmsd (mass mms daemon, carrier only) • alarmd (alarm daemon) • pptpcd (pptp client daemon) • wpad_client (port access client daemon - atheros wifi) • wpad (port access entity daemon - prism54 wifi) • eap_proxy (epa proxy - wpa enterprise wifi) • modemd (modem daemon) • dialinsvr (dial-in server daemon) • cardmgr (pcmcia card manager daemon) • getty aux (getty aux daemon) • pppoatmd (ppp over atm daemon) • adsl_mon (adsl monitor daemon) • l2tpcd (l2tp client daemon) • httpclid (http client daemon) • sessionsync (session sync daemon) • fgfmd (fortigate/fortimanager communication daemon) • wccpd (wccp daemon) • garpd (vip gratuitous arp daemon) • cw_acd (capwap ac daemon) • wpad_ac (wpad ac daemon) • cw_wtpd (capwap wtp daemon) • cw_stad (capwap sta daemon) • fortilinkd (fortilinkd) • cu_acd (cu_acd) • swctrl_authd • vrrpd (vrrp daemon) • usbmuxd (usbmux daemon)

• fsd (forti-start daemon) • proxyacceptor (proxyacceptor daemon) • proxyworker (proxyworker daemons) • sslacceptor (sslacceptor daemon) • sslworker (sslworker daemons) • imd (imd daemons) • fcnacd (forticlient NAC daemon) • stpd_name (spanning tree protocol daemon) • wiredapd (wired ap 802.1x port based auth daemon) • confsynchbd (conf-sync heartbeat daemon) • confsyncd (conf-sync daemon) • poed (poe daemon) • cbp (cbp daemon) • nsm (routing FIB update) • imi (routing related) • bgpd (bgp) • ospfd (ospf) • ospf6d (ospfv3) • pim6d (pim multicast v6) • pimd (pim multicast) • pdmd (pim dense monde) • ripd (rip) • ripngd (ripv6) • netscan (netscan daemon) • dhcp6s (dhcp6 server) • dhcp6r (dhcp6 relay) • dhcp6c (dhcp6 client) • lted (usb lte daemon - start only if hardware has usb port and not run in vmware) • newcli (CLI commands execution - ssh, telnet) • vpd (vpn policy daemon - handle vpn traffic to know to which policy the traffic corresponds) • rlogd (reliable syslog daemon)