You can use the diagnose span-sniffer packet command to sniff traffic on internal FortiGate 6000 or 7000 interfaces in the same way as using the diagnose sniffer packet command to sniff traffic on data or management interfaces. The diagnose span-sniffer packet syntax is similar to the diagnose sniffer packet command syntax. Internal FortiGate 6000 or 7000 interfaces includes internal switch ports (for example, sw:1-P1, sw:7-P4) and the DP processor (dp).

Command syntax for the packet sniffer part of the command is:

diagnose span-sniffer packet <interface> <filter> <verbose> <count> <timestamp> <frame-size>

The <filter> option does not work for internal switch (sw:) interfaces. You can work around this problem by using the default filter (which is "") and using grep to display the information you are looking for. For example, use the following command to see echo request packets:

diagnose span-sniffer packet dp "" 4 | grep echo