Is it possible to sniff for IP numbers that are _not_ in a list?

[tumming]

I have a list of < 300 IP numbers that I know about. We're not using DHCP, so there should be no addresses outside of those 300. I am really curious if there is any traffic going to IP numbers that I don't know about. If there is it could indicate something that is broken, or a hacker trying to discover something. This is obviously would work only on internal ports. 

Any ideas?

[knagaraju]

Hi tumming,

Could you please let me know if IP numbers means Protocol numbers ?

Sniffer command has options which are mentioned in the below link
https://docs.fortinet.com/document/fortigate/6.2.15/cookbook/680228/performing-a-sniffer-trace-cli-a...

Please let me know if you have any additional queries.

Regards
Nagaraju.

[tumming]

No, I meant IP addresses. We call them IP numbers here. I had already rtfm'd and could not find an answer, hence my posting here.

tom

[ebilcari · Accepted solution]

You can create an Address Group with all the known IPs you have in your subnet and create two firewall polices. On the first firewall policy allow access by specifying this group as Source. Clone the same rule and put it below and this time allow all the IP range for that subnet. On the second firewall policy enable "Log Allowed Traffic: All Sessions". This way you can verify if the second policy is used by any other IP (outside of the address group) and what traffic are they generating.

[tumming]

Yes! This looks like what I'm asking for. I already know how to create address groups from the command line, and I can write a simple script to automate creating the command. Then just cut'n paste into the cli. Easy peasy!

I'm going to run this by some other folks here first. If I mess up, I could break things badly.

Thanks for the answer, and actually reading the question! :)

tom

[mle2802]

Hi @tumming,

Do you mean IP address? If that, you can try this command "diag sniffer packet any "host X.X.X.X" 4 0 l" (replace X.X.X.X with your desired IP).

Regards,
Minh

[tumming]

That would work for an individual IP address. What I need is something like "diag sniffer packet not "long list of ip addresses"..

[hbac]

Hi @tumming,

You can sniff any IP addresses. Please refer to https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Packet-Capture-on-FortiOS-GUI/ta-p/1...

Regards, 

[tumming]

I have almost 300 IP addresses. That solution would only work for onesies twosies.