Fortigate 'Capture packets' in policy screen

[Huey]

I see this "Capture packets" option while defining policies.  How do I use it?

[Christopher_McMullan]

The feature causes the FortiGate to log a capture file for each session matching the policy

.I haven't had to test the feature to see where the capture files end up. I think from memory that the log entry for a session should contain a link to the local (or remote) location of the file for download and local viewing.

[Huey]

That sounds correct, I read somewhere that it goes to the logs.  I've been checking under Log and report -> Traffic log -> Sniffer traffic, but theres nothing there and the rule I enabled "Capture packets" on has been getting hits.  Not sure where else to look.  We have FortiAnalyzer setup and the Fortigate is logging to it as well.  I dont see anywhere on FortiAnalyzer that the captured data would show up tho.

[Huey]

Bumping this thread.  Running 5.4.2 and cant find where to display/download the captured packets still.

[Carl_Wallmark]

I tested to enable "Capture Traffic" inside on of my policies.

It shows up in the logs.

FortiGate 100D with 5.4.3

[Huey]

Ok.  Not seeing that on mine.  I am using FortiAnalyzer so that may have something to do with it...

[PDG]

Did you tried it like described in the KB?

http://kb.fortinet.com/kb/documentLink.do?externalID=FD38914

This worked for me.

[Huey]

Yes, those were the directions I followed.  May have something to do with running FortiAnalyzer but not sure.  I looked there as well but no love.