Network monitoring
You can monitor specific unicast MAC addresses in directed mode, monitor all detected MAC addresses on a FortiSwitch unit in survey mode, or do both. The FortiSwitch unit gives the directed mode a higher priority than survey mode. The directed mode and survey mode are disabled by default.
NOTE: Network monitoring is not available on FSR-112D-POE.
This section covers the following topics:
Directed mode
In directed mode, you select which unicast MAC addresses that you want examined. The FortiSwitch unit detects various fields of the packet—such as MAC address, IP address, VLAN, and user name—and stores the data in either of two databases.
NOTE: You cannot specify broadcast or multicast MAC addresses.
The maximum number of MAC addresses that can be monitored depends on the FortiSwitch model.
|
Platform Series |
Maximum Number of MAC Addresses Monitored |
Maximum Number of Hosts |
|---|---|---|
|
1xx, 2xx |
10 |
250 |
|
4xx, 5xx |
20 |
1,024 |
|
10xx, 30xx |
30 |
4,096 |
To find out how many network monitors are available, use the following command:
diagnose switch network-monitor cfg-stats
Network Monitor Configuration Statistics:
----------------------------------
Adds : 0
Deletes : 0
Free Entries : 20
To find out which network monitors are being used currently, use the following command:
diagnose switch network-monitor dump-monitors
Entry ID Monitor Type Monitor MAC Packet-count ================================================================= 1 directed-mode 00:01:02:03:04:05 10 2 directed-mode 10:01:02:03:04:05 0 3 survey-mode 08:5b:0e:c1:07:65 419 4 survey-mode 08:5b:0e:4f:af:38 101 5 survey-mode 08:5b:0e:ce:59:40 2347 6 survey-mode 08:5b:0e:4f:af:44 0 7 survey-mode 08:5b:0e:c1:07:65 0 8 survey-mode 08:5b:0e:4f:af:38 80 9 survey-mode 08:5b:0e:ce:59:40 117 10 survey-mode 08:5b:0e:4f:af:44 0
To start network monitoring, use the following commands:
config switch network-monitor settings
set status enable
end
To specify a single unicast MAC address (formatted like this: xx:xx:xx:xx:xx:xx) to be monitored, use the following commands:
config switch network-monitor directed
edit <unused network monitor>
set monitor-mac <MAC address>
next
end
For example:
config switch network-monitor directed
edit 1
set monitor-mac 00:25:00:61:64:6d
next
end
Survey mode
In survey mode, the FortiSwitch unit detects MAC addresses to monitor for a specified number of seconds. You can specify network monitoring for 120 to 3,600 seconds. The default time is 120 seconds. The FortiSwitch unit detects various fields of the packet—such as MAC address, IP address, VLAN, and user name—and stores the data in either of two databases.
To start network monitoring in survey mode, use the following commands:
config switch network-monitor settings
set status enable
set survey-mode enable
set survey-mode-interval <120-3600 seconds>
end
For example:
config switch network-monitor settings
set status enable
set survey-mode enable
set survey-mode-interval 480
end
Network monitoring statistics
After you have enabled network monitoring, you can view the statistics for the number and types of packets.
To see the type of packets going to and from monitored MAC addresses, use the following command:
diagnose switch network-monitor parser-stats
Network Monitor Parser Statistics:
----------------------------------
Arp : 0
Ip : 1
Udp : 46
Tcp : 353
Dhcp : 0
Eapol : 0
Unsupported : 352
To see the number of packets going to and from monitored MAC addresses, use the following command:
diagnose switch network-monitor dump-monitors
Entry ID Monitor Type Monitor MAC Packet-count ================================================================= 1 directed-mode 00:01:02:03:04:05 10 2 directed-mode 10:01:02:03:04:05 0 3 survey-mode 08:5b:0e:c1:07:65 419 4 survey-mode 08:5b:0e:4f:af:38 101 5 survey-mode 08:5b:0e:ce:59:40 2347 6 survey-mode 08:5b:0e:4f:af:44 0 7 survey-mode 08:5b:0e:c1:07:65 0 8 survey-mode 08:5b:0e:4f:af:38 80 9 survey-mode 08:5b:0e:ce:59:40 117 10 survey-mode 08:5b:0e:4f:af:44 0
NOTE: The FortiSwitch unit creates an entry in the layer-3 database using the exact packet contents when they were parsed. If the MAC address is then assigned to a different VLAN, this change might not be detected immediately. If there is a discrepancy in the output for the diagnose switch network-monitor dump-l2-db and diagnose switch network-monitor dump-l3-db commands, use the output with the more recent time stamp.
To see all detected devices from the layer-2 database, use the following command:
diagnose switch network-monitor dump-l2-db
mac 00:01:02:03:04:05 vlan 1
created 19 secs ago, last seen 16 secs ago
user JoE sources: eapol
To see all detected devices from the IP address database, use the following command:
diagnose switch network-monitor dump-l3-db
mac 08:5b:0e:c1:07:65 ip 169.254.2.2 vlan 4094
created 63614 secs ago, last seen 2 secs ago
sources: arp ip
mac 00:10:20:30:40:50 ip 10.10.10.111 vlan 123
created 75 secs ago, last seen 45 secs ago
sources: arp ip
mac 00:11:22:33:44:55 ip 30.30.30.115 vlan 1
created 53 secs ago, last seen 53 secs ago
sources: dhcp arp ip