Using Traffic Capture
When troubleshooting networks, review the contents of the packets. Reviewing the packets may determine if the packets, route, and destination are accurate. Traffic capture assists in troubleshooting various problems, such as:
- finding missing traffic
- monitoring session setup
- locating ARP problems, such as broadcast storm sources and causes
- confirming which address a computer is using on the network and if they have multiple addresses or are on multiple networks
- monitoring functioning routing
- intermittent missing PING packets.
If running a constant traffic application, such as ping, traffic capture displays if the traffic is reaching the destination, how the port enters and exits the FortiRecorder unit, if the ARP resolution is correct, and if the traffic is returning to the source as expected.
To capture the traffic
- Go to System > Network > Traffic Capture.
- Select New.
- Enter a description for the file generated from the captured traffic.
- Select the time period for performing the packet capture from the Duration drop-down menus.
- Specify which interface to capture from the Interface drop-down menu.
- Enter a maximum of three IP addresses or host names to capture in the IP/Host field to limit the scope of traffic capture.
- Select the filter for the traffic capture. Select Use protocol to capture UDP or TCP traffic on the specified port number or None.
- Enter the IP address/host names and port numbers to not capture in the Exclusion field
- Select Create.
The generated PCAP file is viewable in Wireshark.