New "diagnose debug traffic..."

[AlexFerenX]

Hi!

FortiGate / FortiOS 7.0.0 FortiOS Release Notes introduces:

677784

Add commands to debug traffic statistics for traffic monitor interfaces (interface), interface traffic in real-time data (peek), and to dump interface traffic history data (history): # diagnose debug traffic {interface | peek | history}

without further elucidation.

Anyone (esp. Fortinet) can provide clues on use-case and usage?

Thanks, Feren.

[jiyong]

Hi @AlexFerenX 

When checking the above command, it looks like this:

interface : List traffic monitor interface.
peek : Display interface traffic real-time data.
history : Dump interface traffic history data.

To use the above debug, the settings below must be enabled.

config system interface

edit mgmt

set monitor-bandwidth enable

Thanks.

[AlexFerenX]

Hi @jiyong, can you show actual printouts (ie. with useful data)... ? Thanks!

[jiyong]

I think it is expressed in bytes, but I think I need to look for more information.

# diagnose debug traffic interface
Interfaces:
port1

1 monitored interfaces.

# diagnose debug traffic peek port1 1

# diagnose debug traffic history port1 1
1725951565 - 4329751745
( 4717048, 1235128)
---------------------------------------------
000 - ( 0, 0)
001 - ( 13528, 10576)
002 - ( 7792, 6480)
003 - ( 5928, 6344)

[AlexFerenX]

Hi @jiyong ,

> I think it is expressed in bytes, but I think I need to look for more information.

this is the reason for this forum question (not because I cannot press "?" after typing "diagnose debug traffic").

The key omission is "introduces ... without further elucidation." Was this feature a requirement from a specific customer, so Fortinet wasn't obligated to document wider?

Thanks, Feren.

[jiyong]

Hi Freren,

Good day!

Please open a FortiCare ticket to check and provide details about this feature.

[AlexFerenX]

Hi @jiyong ,

> Please open a FortiCare ticket to check and provide details about this feature.

These are typical response from Fortinet Support for non-fault Tickets:

• "Why do you need it?"
• "What are you trying to achieve?"
• "What is current problem?"

to which I typically respond with "... because Fortinet didn't document it!" which lead nowhere satisfactory. I can provide a current Ticket # that perfectly demonstrates these tactics.

R's, Feren

[AlexFerenX]

Hi @jiyong 

---

@jiyong wrote:

Hi @AlexFerenX 

:

To use the above debug, the settings below must be enabled.

config system interface

edit mgmt

set monitor-bandwidth enable

No, that cannot be correct - I've done same, and don't see any output:

CENSORED (vdom-ext) # show system interface port7
config system interface
edit "port7"
set vdom "vdom-ext"
set ip CENSORED 255.255.255.248
set allowaccess ping
set type physical
set description "CENSORED"
set alias "Upstream to CENSORED""
set monitor-bandwidth enable
set snmp-index 25
next
end

CENSORED (vdom-ext) # diagnose debug traffic interface

CENSORED (vdom-ext)

No output! There must be more to this.

Thanks.

[kmohan]

Hi Alex,

It's a bug on the release notes 7.0.0

Summary:
Incorrect bandwidth utilization on interface traffic widget

Example:

ISP is connected to any interface( Port1) of the device. Maximum traffic provided by ISP 50Mbps.
-However Bandwidth utilization graph for 'inbound' traffic on the interface traffic widget shows 82Mbps

- Due to incorrect interface utilization data.

To check via CLI follow the below command.

To help with debugging interface's traffic statistic, new diagnose commands are added "diagnose debug traffic interface/peek/history"

CLI Changes:
Add:diagnose debug traffic xxx

Details:
# diagnose debug traffic ?
interface List traffic monitor interface.
peek Display interface traffic real-time data.
history Dump interface traffic history data.