diag sniffer packet showing eth0 ?????

[dirkdigs]

im doing a packet capture on all interfaces from a host on my internal LAN. port 80,443 only. i want to know if the web traffic is exiting using wan1 or wan2. but the packet capture shows internal > eth0 ??? what is eth0 ??

[dirkdigs]

diagnose sniffer packet any ' host 192.168.121.10 and port 80' 4interfaces=[any] filters=[host 192.168.121.10 and port 80] 14.311137 port1 in 192.168.121.10.59980 -> 157.166.226.26.80: syn 3623370317 14.311210 port1 out 157.166.226.26.80 -> 192.168.121.10.59980: syn 527433776 ack 3623370318 14.311218 eth0 out 157.166.226.26.80 -> 192.168.121.10.59980: syn 527433776 ack 3623370318 14.311427 port1 in 192.168.121.10.59981 -> 157.166.226.26.80: syn 4058517292 14.311519 port1 out 157.166.226.26.80 -> 192.168.121.10.59981: syn 1369946539 ack 4058517293 14.311533 eth0 out 157.166.226.26.80 -> 192.168.121.10.59981: syn 1369946539 ack 4058517293 14.311544 port1 in 192.168.121.10.59980 -> 157.166.226.26.80: ack 527433777 14.311815 port1 in 192.168.121.10.59981 -> 157.166.226.26.80: ack 1369946540 14.396239 port1 in 192.168.121.10.59980 -> 157.166.226.26.80: psh 3623370318 ack 527433777 14.396274 port1 out 157.166.226.26.80 -> 192.168.121.10.59980: ack 3623370651 14.396281 eth0 out 157.166.226.26.80 -> 192.168.121.10.59980: ack 3623370651 15.727360 port1 out 157.166.226.26.80 -> 192.168.121.10.59980: psh 527433777 ack 3623370651 15.727371 eth0 out 157.166.226.26.80 -> 192.168.121.10.59980: psh 527433777 ack 3623370651 15.927639 port1 in 192.168.121.10.59980 -> 157.166.226.26.80: ack 527434224 15.982804 port1 in 192.168.121.10.59982 -> 157.166.238.48.80: syn 4275520368 15.982884 port1 out 157.166.238.48.80 -> 192.168.121.10.59982: syn 3887095537 ack 4275520369 15.982890 eth0 out 157.166.238.48.80 -> 192.168.121.10.59982: syn 3887095537 ack 4275520369 15.983157 port1 in 192.168.121.10.59982 -> 157.166.238.48.80: ack 3887095538 15.983263 port1 in 192.168.121.10.59983 -> 157.166.238.48.80: syn 718208846 15.983346 port1 out 157.166.238.48.80 -> 192.168.121.10.59983: syn 1502454981 ack 718208847 15.983357 eth0 out 157.166.238.48.80 -> 192.168.121.10.59983: syn 1502454981 ack 718208847 15.983589 port1 in 192.168.121.10.59983 -> 157.166.238.48.80: ack 1502454982 15.984190 port1 in 192.168.121.10.59982 -> 157.166.238.48.80: psh 4275520369 ack 3887095538 15.984231 port1 out 157.166.238.48.80 -> 192.168.121.10.59982: ack 4275520706 15.984238 eth0 out 157.166.238.48.80 -> 192.168.121.10.59982: ack 4275520706 19.308550 port1 out 157.166.238.48.80 -> 192.168.121.10.59982: 3887095538 ack 4275520706 19.308560 eth0 out 157.166.238.48.80 -> 192.168.121.10.59982: 3887095538 ack 4275520706 19.308575 port1 out 157.166.238.48.80 -> 192.168.121.10.59982: 3887096998 ack 4275520706 19.308582 eth0 out 157.166.238.48.80 -> 192.168.121.10.59982: 3887096998 ack 4275520706 19.309254 port1 in 192.168.121.10.59982 -> 157.166.238.48.80: ack 3887098458 19.309311 port1 out 157.166.238.48.80 -> 192.168.121.10.59982: 3887098458 ack 4275520706 19.309319 eth0 out 157.166.238.48.80 -> 192.168.121.10.59982: 3887098458 ack 4275520706 19.309332 port1 out 157.166.238.48.80 -> 192.168.121.10.59982: 3887099918 ack 4275520706 19.309338 eth0 out 157.166.238.48.80 -> 192.168.121.10.59982: 3887099918 ack 4275520706 19.309347 port1 out 157.166.238.48.80 -> 192.168.121.10.59982: 3887101378 ack 4275520706 19.309353 eth0 out 157.166.238.48.80 -> 192.168.121.10.59982: 3887101378 ack 4275520706 19.309960 port1 in 192.168.121.10.59982 -> 157.166.238.48.80: ack 3887101378 19.309996 port1 out 157.166.238.48.80 -> 192.168.121.10.59982: 3887102838 ack 4275520706 19.310005 eth0 out 157.166.238.48.80 -> 192.168.121.10.59982: 3887102838 ack 4275520706 19.310022 port1 out 157.166.238.48.80 -> 192.168.121.10.59982: 3887104298 ack 4275520706 19.310031 eth0 out 157.166.238.48.80 -> 192.168.121.10.59982: 3887104298 ack 4275520706 19.310045 port1 out 157.166.238.48.80 -> 192.168.121.10.59982: psh 3887105758 ack 4275520706 19.310054 eth0 out 157.166.238.48.80 -> 192.168.121.10.59982: psh 3887105758 ack 4275520706 19.310560 port1 in 192.168.121.10.59982 -> 157.166.238.48.80: ack 3887104298 19.310607 port1 out 157.166.238.48.80 -> 192.168.121.10.59982: 3887107218 ack 4275520706 19.310619 eth0 out 157.166.238.48.80 -> 192.168.121.10.59982: 3887107218 ack 4275520706 19.310636 port1 out 157.166.238.48.80 -> 192.168.121.10.59982: 3887108678 ack 4275520706 19.310644 eth0 out 157.166.238.48.80 -> 192.168.121.10.59982: 3887108678 ack 4275520706 19.310658 port1 out 157.166.238.48.80 -> 192.168.121.10.59982: 3887110138 ack 4275520706 19.310666 eth0 out 157.166.238.48.80 -> 192.168.121.10.59982: 3887110138 ack 4275520706 19.310832 port1 in 192.168.121.10.59982 -> 157.166.238.48.80: ack 3887107218 19.310863 port1 out 157.166.238.48.80 -> 192.168.121.10.59982: psh 3887111598 ack 4275520706 19.310869 eth0 out 157.166.238.48.80 -> 192.168.121.10.59982: psh 3887111598 ack 4275520706 19.310901 port1 out 157.166.238.48.80 -> 192.168.121.10.59982: 3887113058 ack 4275520706 19.310909 eth0 out 157.166.238.48.80 -> 192.168.121.10.59982: 3887113058 ack 4275520706 19.310931 port1 out 157.166.238.48.80 -> 192.168.121.10.59982: 3887114518 ack 4275520706 19.310939 eth0 out 157.166.238.48.80 -> 192.168.121.10.59982: 3887114518 ack 4275520706 19.311246 port1 in 192.168.121.10.59982 -> 157.166.238.48.80: ack 3887110138

[dirkdigs]

Another way is to use " debug flow" CLI to troubleshoot it <-- this worked still not sure why when using " diag sniff packet" it shows me a strange " eth0" interface in my capture. if anyone knows please reply.

[emnoc]

This comes up lately & about eth0. Since the fortigate is a linux host, I think eth0 is always the main interface. If you use diag hardware deviceinfo nic eth0 or fnsysctl ifconfig eth0 you will see the eth0 interface but surprisely you can' t use it in a diag sniffer packet eth0 " any" for example For the OP modify your filter to use the src and dst ports and the actual interface if you don' t want the eth0 in the output

[dirkdigs]

i want to trace a host on the internal network 192.168.1.x and confirm that port 80 (http) traffic is using wan2 exclusively.

[emnoc]

Than be specific in your syntax diag sniffer packet wan2 " host 192.168.1.x and port 80 or 443 " if you doubt wan2, change it to wan1 or whatever port you suspect, bug diag debug flow will not lie or mis-lead you.

[FortiRack_Eric]

eth0 shows up in some FortiGate models with switch interfaces, in that case the eth0 is the parent of the individual interfaces. You can ignore always eth0 output