Interface eth0

[200B]

Hi, I have a fortigate 110C V4.0MR3 P14 which will show traffic exiting port1 or port3 as also exiting interface eth0. Interface eth0 does not appear on the interface configuration. diag hardware deviceinfo nic eth0 returns information on packets sent/received diag hardware deviceinfo nic port1 returns information on packets sent/received but omits many categories including: Rx_Errors Tx_errors Collisions Rx_Length_Errors Rx_Over_Errors Rx_Frame_Errors Tx_aborted_Errors Tx_carrier_errors Rx_CRC_Errors eth0 has these categories (with zero counted in each), but other ports do not. Any thoughts?

[emnoc]

diag hardware deviceinfo nic eth0

I think that' s a pusedo interface but stangely m 110C has a eth0; FW1LAW # diag hardware deviceinfo nic eth0 Description Broadcom 570x Tigon3 Ethernet Adapter Part_Number BCM95786T8600 PHY_Device_ID 5787 Driver_Name tg3 Driver_Version 3.85l PCI_Vendor 0x14e4 PCI_Device_ID 0x169a PCI_Subsystem_Vendor 0x14e4 PCI_Subsystem_ID 0x969a PCI_Revision_ID 0xb002 PCI_Address 1:0.0 Memory 0xdfc00000 IRQ 9 System_Device_Name eth0 Current_HWaddr 00:09:0f:ca:f9:7e Permanent_HWaddr 00:09:0f:ca:f9:7e Link up Speed 1000 Mbps full duplex FlowControl Tx off, Rxoff MTU_Size 1500 Rx_Packets 247284410 Rx_Packets_Dropped 0 Tx_Packets 338341834 Rx_Bytes 1501420373 Tx_Bytes 2229875905 Rx_Errors 0 Tx_errors 0 Multicast 1160947 Collisions 0 Rx_Length_Errors 0 Rx_Over_Errors 0 Rx_Frame_Errors 0 Tx_aborted_Errors 0 Tx_carrier_errors 0 Rx_CRC_Errors 0 rx_pending 200 tx_pending 511 tg3_flags a2486c05 tg3_flags2 380c9200 but it' s not an interface you can sniffer on; diag sniffer packet <interface> the network interface to sniff (or " any" ) FG100C3G09611205 # diag sniffer packet eth0 " any" interfaces=[eth0] filters=[any] pcap_lookupnet: eth0: no IPv4 address assigned pcap_compile: parse error and version of code; Version: Fortigate-110C v4.0,build0196,100319 (MR1 Patch 4) Qs: Where are you seeing traffic exiting eth0? Are you using any IPS or end-point UTM features ? What does " get sys performance status" show? And " diag ip arp list " 7 " diag ip address list" show for you ip_address L3 interfaces ?

[200B]

Where are you seeing traffic exiting eth0? Are you using any IPS or end-point UTM features ?

using diag sniffer packet any ' filters' 4 to give the interface name

What does " get sys performance status" show?

CPU states: 0% user 0% system 0% nice 100% idle CPU0 states: 0% user 0% system 0% nice 100% idle Memory states: 16% used Average network usage: 2090 kbps in 1 minute, 1596 kbps in 10 minutes, 2186 kbps in 30 minutes Average sessions: 373 sessions in 1 minute, 323 sessions in 10 minutes, 298 sessions in 30 minutes Average session setup rate: 1 sessions per second in last 1 minute, 2 sessions per second in last 10 minutes, 1 sessions per second in last 30 minutes Virus caught: 0 total in 1 minute IPS attacks blocked: 0 total in 1 minute Uptime: 27 days, 1 hours, 41 minutes

And " diag ip arp list " 7 " diag ip address list" show for you ip_address L3 interfaces ?

They show the L3 interfaces on port3, no references to eth0...

[emnoc]

Okay that' s good. I believe you can ignore that. Eth0 is problem something that replicating packets for one of the UTM features or offloading. e.g diag sniffer packet any ' arp' 4 interfaces=[any] filters=[arp] 0.601971 wan2 out arp who-has 192.168.11.68 tell 192.168.11.73 0.601976 eth0 out arp who-has 192.168.11.68 tell 192.168.11.73 2.513880 wan2 in arp reply 192.168.0.120 is-at d4:ae:52:bd:e4:fe 5.624268 wan2 in arp who-has 192.168.11.73 tell 192.168.11.67 5.624281 wan2 out arp reply 192.168.11.73 is-at 0:9:f:ca:f9:7f 5.624284 eth0 out arp reply 192.168.11.73 is-at 0:9:f:ca:f9:7f 6.382000 wan2 out arp who-has 192.168.254.2 tell 192.168.254.1 6.382005 eth0 out arp who-has 192.168.254.2 tell 192.168.254.1 6.382202 wan2 in arp reply 192.168.254.2 is-at 3c:4a:92:f5:e6:1c 9 packets received by filter 0 packets dropped by kernel ~ Are you experiencing performance issues? or just curious on eth0? fwiw: All of the firewall that I checked, exhibits the same. I fogot to add this http://docs-legacy.fortinet.com/cb/html/index.html#page/FOS_Cookbook/Install_advanced/cb_appendix_diags.html hardware deviceinfo nic eth0 Display information about the network card attached to the interface. The information displayed varies by the type of NIC. It will include the VLAN id, state, link, speed, counts for received and transmitted packets and bytes. The MAC for this NIC is Current_HWaddr and Permant_HWaddr, and this is only place you can see both the old and new MAC when it is changed.

[200B]

Are you experiencing performance issues? or just curious on eth0?

Just curious :) Also curious re the counts under diag hardware deviceinfo nic port1 I don' t see any numbers on rx/tx errors/collisions. Will these only appear if the counts are nonzero?

[emnoc]

rx/tx errors/collisions

Yes only if they appear. Collision should never been seen in a full-duplex setting. Collision, CRC and late collision are normally a duplex miss-match or if a 802.1q tag is being applied and the other party is not expecting it. Man your question was challenging, I remember some fortinet rep explain the eth0 and I can' t recall what it' s used for now I would not worry too much about it unless your see performance issues or numbers are climbing on a regular schedule.

[200B]

Thats ok, thanks for your input emnoc!