Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Products Best Practices Hardware Guides Products A-Z
Summary
By Solution
By 4D Pillars
By Cloud
Secure Networking
Unified SASE
Security Operations
Secure SD-WAN
Secure Access Service Edge (SASE)
ZTNA
LAN Edge
Identity and Access Management
Next Generation Firewall
Public Cloud
Private Cloud
FortiCloud
Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
    • More >>
    Unified SASE
  • Single Vendor SASE
  • Cloud Network Security
  • Secure Endpoint Connectivity
  • Web Application / API Protection
    • More >>
    Security Operations
  • Security Operations Automation
  • Identity
  • Early Detection & Prevention
    • More >>
    Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
  • Communication & Surveillance
    • Unified SASE
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Cloud Network Security
  • Cloud-Native Security
  • Web Application / API Protection
    • Security Operations
  • Security Operations Automation
  • Endpoint
  • Data Protection
  • Identity
  • Email
  • Early Detection & Prevention
  • Expert Services
  • Edge Firewall
  • Orchestration & management
  • SD Branch
  • Application Delivery
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Secure Private Access
  • Thin Edge
  • Identity
  • Application Gateway
  • Enterprise Asset Management
  • Endpoint Agent
  • Agentless Security Posture
  • Identity
  • Wireless
  • Switching
  • Identity
  • Privilege Acccess Management
  • Next Generation Firewall
  • Orchestration & management
  • Expert Services
  • All
  • All
  • Account Management
  • SAAS Management
  • SAAS Application Security
  • Managed Services
  • Platform as a service (PAAS)
  • Other SAAS Services
    • 4D Resources
    Solution Hubs
  • 4D Pillars
  • Cloud
  • Popular Solutions

    • Hardware Acceleration

    Home FortiGate / FortiOS 6.2.9 Hardware Acceleration
    6.2.9
    7.6.0
    7.4.5
    7.4.4
    7.4.3
    7.4.2
    7.4.1
    7.4.0
    7.2.10
    7.2.9
    7.2.8
    7.2.7
    7.2.6
    7.2.5
    7.2.4
    7.2.3
    7.2.2
    7.2.1
    7.2.0
    7.0.16
    7.0.15
    7.0.14
    7.0.13
    7.0.12
    7.0.11
    7.0.10
    7.0.9
    7.0.8
    7.0.7
    7.0.6
    7.0.5
    7.0.1
    7.0.0
    6.4.15
    6.4.14
    6.4.13
    6.4.12
    6.4.11
    6.4.10
    6.4.9
    6.4.8
    6.4.6
    6.4.5
    6.2.16
    6.2.15
    6.2.14
    6.2.13
    6.2.12
    6.2.9
    6.2.7
    6.0.18
    6.0.17
    6.0.16
    6.0.15
    6.0.14
    5.6.0

    NP7 packet sniffer

    NP7 packet sniffer

    You can use the following command as a packet sniffer for traffic offloaded to NP7 processors. You can also use this command to mirror sniffed packets to a FortiGate interface.

    diagnose npu sniffer {start | stop | filter}

    Use start and stop to start or stop displaying packets on the CLI. Before the sniffer will start you need to use the filter to specify the packets to display. Use the command diagnose sniffer packet npudbg to display sniffed packets on the CLI.

    Use filter to create a definition of the types of packets to display. Filter options include:

    selector you can create up to four filters (numbered 0 to 3). Use this command to create a new filter or select the stored filter to be used when you start the packet sniffer. You can also use this command to have multiple filters active at one time. See below for an example of sniffing using multiple active filters.

    intf <interface-name> the name of an interface to display packets passing through that interface. You can monitor traffic on any interface except IPv4 or IPv6 IPsec VPN tunnel interfaces.

    dir {0 | 1 | 2} the direction of the packets passing through the interface. 0 displays ingress packets, 1 displays egress packets, and 2 displays both ingress and egress packets.

    ethtype <type> the ethertype of the packets to sniff if you want to see non-IP packets.

    protocol <number> the IP protocol number of the packets to sniff in the range 0 to 255. The packet sniffer can only sniff protocols that can be offloaded by the NP7 processors.

    srcip <ipv4-ip-address>/<ipv4-mask> an IPv4 IP address and netmask that matches the source address of the packets to be sniffed.

    dstip <ipv4-ip-address>/<ipv4-mask> an IPv4 IP address and netmask that matches the destination address of the packets to be sniffed.

    ip <ipv4-ip-address>/<ipv4-mask> an IPv4 IP address and netmask that matches a source or destination address in the packets to be sniffed.

    srcip6 <ipv6-ip-address>/<ipv6-mask> an IPv6 IP address and netmask that matches the source address of the packets to be sniffed.

    dstip6 <ipv6-ip-address>/<ipv6-mask> an IPv6 IP address and netmask that matches the destination address of the packets to be sniffed.

    ip6 <ipv6-ip-address>/<ipv6-mask> an IPv6 IP address and netmask that can match source or destination addresses in the packets to be sniffed.

    sport <port-number> layer 4 source port of the packets to be sniffed.

    dport <port-number> layer 4 destination port of the packets to be sniffed.

    port <port-number> layer 4 source or destination port of the packets to be sniffed.

    outgoing_intf <interface> the name of the interface out of which to send mirrored traffic matched by the filter.

    outgoing_vlan <vlan-id> the VLAN ID added to mirrored traffic matched by the filter and sent out the mirror interface.

    clear clear all filters.

    Packet sniffer examples

    See this Fortinet Community article for an NP7 packet sniffer example: Troubleshooting Tip: Collecting NP7 packet capture without disabling offload.

    Here is a basic example to sniff offloaded TCP packets received by the port23 interface. In the following example:

    • The first line clears the filter.

    • The second line sets the sniffer to look for packets on port23.

    • The third line looks for packets exiting the interface.

    • The fourth line looks for TCP packets.

    • The fifth line starts the sniffer.

    • The sixth line starts displaying the packets on the CLI.

    diagnose npu sniffer filter

    diagnose npu sniffer filter intf port23

    diagnose npu sniffer filter dir 2

    diagnose npu sniffer filter protocol 6

    diagnose npu sniffer start

    diagnose sniffer packet npudbg

    An example that uses the following two filters:

    • The first filter, selector 0, looks for incoming and outgoing TCP packets on port1.

    • The second filter, selector 1, looks for outgoing UDP packets on port2.

    • The final line starts displaying packets for both filters on the CLI.

    diagnose npu sniffer filter selector 0

    diagnose npu sniffer filter intf port1

    diagnose npu sniffer filter protocol 6

    diagnose npu sniffer filter dir 2

    diagnose npu sniffer start

    diagnose npu sniffer filter selector 1

    diagnose npu sniffer filter intf port2

    diagnose npu sniffer filter protocol 17

    diagnose npu sniffer filter dir 1

    diagnose npu sniffer start

    diagnose sniffer packet npudbg

    Previous
    Next

    NP7 packet sniffer

    NP7 packet sniffer

    You can use the following command as a packet sniffer for traffic offloaded to NP7 processors. You can also use this command to mirror sniffed packets to a FortiGate interface.

    diagnose npu sniffer {start | stop | filter}

    Use start and stop to start or stop displaying packets on the CLI. Before the sniffer will start you need to use the filter to specify the packets to display. Use the command diagnose sniffer packet npudbg to display sniffed packets on the CLI.

    Use filter to create a definition of the types of packets to display. Filter options include:

    selector you can create up to four filters (numbered 0 to 3). Use this command to create a new filter or select the stored filter to be used when you start the packet sniffer. You can also use this command to have multiple filters active at one time. See below for an example of sniffing using multiple active filters.

    intf <interface-name> the name of an interface to display packets passing through that interface. You can monitor traffic on any interface except IPv4 or IPv6 IPsec VPN tunnel interfaces.

    dir {0 | 1 | 2} the direction of the packets passing through the interface. 0 displays ingress packets, 1 displays egress packets, and 2 displays both ingress and egress packets.

    ethtype <type> the ethertype of the packets to sniff if you want to see non-IP packets.

    protocol <number> the IP protocol number of the packets to sniff in the range 0 to 255. The packet sniffer can only sniff protocols that can be offloaded by the NP7 processors.

    srcip <ipv4-ip-address>/<ipv4-mask> an IPv4 IP address and netmask that matches the source address of the packets to be sniffed.

    dstip <ipv4-ip-address>/<ipv4-mask> an IPv4 IP address and netmask that matches the destination address of the packets to be sniffed.

    ip <ipv4-ip-address>/<ipv4-mask> an IPv4 IP address and netmask that matches a source or destination address in the packets to be sniffed.

    srcip6 <ipv6-ip-address>/<ipv6-mask> an IPv6 IP address and netmask that matches the source address of the packets to be sniffed.

    dstip6 <ipv6-ip-address>/<ipv6-mask> an IPv6 IP address and netmask that matches the destination address of the packets to be sniffed.

    ip6 <ipv6-ip-address>/<ipv6-mask> an IPv6 IP address and netmask that can match source or destination addresses in the packets to be sniffed.

    sport <port-number> layer 4 source port of the packets to be sniffed.

    dport <port-number> layer 4 destination port of the packets to be sniffed.

    port <port-number> layer 4 source or destination port of the packets to be sniffed.

    outgoing_intf <interface> the name of the interface out of which to send mirrored traffic matched by the filter.

    outgoing_vlan <vlan-id> the VLAN ID added to mirrored traffic matched by the filter and sent out the mirror interface.

    clear clear all filters.

    Packet sniffer examples

    See this Fortinet Community article for an NP7 packet sniffer example: Troubleshooting Tip: Collecting NP7 packet capture without disabling offload.

    Here is a basic example to sniff offloaded TCP packets received by the port23 interface. In the following example:

    • The first line clears the filter.

    • The second line sets the sniffer to look for packets on port23.

    • The third line looks for packets exiting the interface.

    • The fourth line looks for TCP packets.

    • The fifth line starts the sniffer.

    • The sixth line starts displaying the packets on the CLI.

    diagnose npu sniffer filter

    diagnose npu sniffer filter intf port23

    diagnose npu sniffer filter dir 2

    diagnose npu sniffer filter protocol 6

    diagnose npu sniffer start

    diagnose sniffer packet npudbg

    An example that uses the following two filters:

    • The first filter, selector 0, looks for incoming and outgoing TCP packets on port1.

    • The second filter, selector 1, looks for outgoing UDP packets on port2.

    • The final line starts displaying packets for both filters on the CLI.

    diagnose npu sniffer filter selector 0

    diagnose npu sniffer filter intf port1

    diagnose npu sniffer filter protocol 6

    diagnose npu sniffer filter dir 2

    diagnose npu sniffer start

    diagnose npu sniffer filter selector 1

    diagnose npu sniffer filter intf port2

    diagnose npu sniffer filter protocol 17

    diagnose npu sniffer filter dir 1

    diagnose npu sniffer start

    diagnose sniffer packet npudbg

    Previous
    Next