Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
tumming
New Contributor II

Is it possible to sniff for IP numbers that are _not_ in a list?

I have a list of < 300 IP numbers that I know about. We're not using DHCP, so there should be no addresses outside of those 300. I am really curious if there is any traffic going to IP numbers that I don't know about. If there is it could indicate something that is broken, or a hacker trying to discover something. This is obviously would work only on internal ports. 

 

Any ideas?

1 Solution
ebilcari
Staff
Staff

You can create an Address Group with all the known IPs you have in your subnet and create two firewall polices. On the first firewall policy allow access by specifying this group as Source. Clone the same rule and put it below and this time allow all the IP range for that subnet. On the second firewall policy enable "Log Allowed Traffic: All Sessions". This way you can verify if the second policy is used by any other IP (outside of the address group) and what traffic are they generating.

- Emirjon
If you have found a solution, please like and accept it to make it easily accessible for others.

View solution in original post

8 REPLIES 8
knagaraju
Staff
Staff

Hi tumming,

Could you please let me know if IP numbers means Protocol numbers ?

Sniffer command has options which are mentioned in the below link
https://docs.fortinet.com/document/fortigate/6.2.15/cookbook/680228/performing-a-sniffer-trace-cli-a...

Please let me know if you have any additional queries.

Regards
Nagaraju.

 

tumming
New Contributor II

No, I meant IP addresses. We call them IP numbers here. I had already rtfm'd and could not find an answer, hence my posting here.

 

tom

ebilcari
Staff
Staff

You can create an Address Group with all the known IPs you have in your subnet and create two firewall polices. On the first firewall policy allow access by specifying this group as Source. Clone the same rule and put it below and this time allow all the IP range for that subnet. On the second firewall policy enable "Log Allowed Traffic: All Sessions". This way you can verify if the second policy is used by any other IP (outside of the address group) and what traffic are they generating.

- Emirjon
If you have found a solution, please like and accept it to make it easily accessible for others.
tumming
New Contributor II

Yes! This looks like what I'm asking for. I already know how to create address groups from the command line, and I can write a simple script to automate creating the command. Then just cut'n paste into the cli. Easy peasy!

 

I'm going to run this by some other folks here first. If I mess up, I could break things badly.

 

Thanks for the answer, and actually reading the question! :)

 

tom

mle2802
Staff
Staff

Hi @tumming,

Do you mean IP address? If that, you can try this command "diag sniffer packet any "host X.X.X.X" 4 0 l" (replace X.X.X.X with your desired IP).

Regards,
Minh

tumming
New Contributor II

That would work for an individual IP address. What I need is something like "diag sniffer packet not "long list of ip addresses"..

 

hbac
Staff
Staff

Hi @tumming,

 

You can sniff any IP addresses. Please refer to https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Packet-Capture-on-FortiOS-GUI/ta-p/1...

 

Regards, 

tumming
New Contributor II

I have almost 300 IP addresses. That solution would only work for onesies twosies.

 

Top Kudoed Authors