ronutz

Construtor de sniffer de pacotes do FortiOS

Monte um comando diagnose sniffer packet do FortiGate a partir das partes, ou cole um para ter cada argumento explicado: interface, filtro, verbosidade 1-6, contagem e formato de horário.

Documentação (Markdown)

Redes

Roda localmente no seu navegador. Nada do que você digita ou cola sai desta página.

Comando
diagnose sniffer packet any none 4 0 l
Notas
  • On the 'any' interface (and on VLAN interfaces), the VLAN tag is stripped from the output at verbose 3/6. To capture the VLAN tag, run the sniffer on the underlying physical interface and match on the tag, e.g. "ether[14:2]=0x00db" for VLAN 219.
  • If expected packets never appear, the session may be hardware-offloaded (NP/SoC). The kernel sniffer cannot see offloaded sessions; temporarily set 'set auto-asic-offload disable' in the matching firewall policy while troubleshooting.
  • An unlimited, unfiltered capture over SSH can flood your own session with the very traffic your SSH connection generates. Add a filter (or exclude 'not port 22') and/or a packet count.
Detalhamento dos argumentos
interfaceany

Capture on all interfaces. Note that on 'any' the link layer is Linux cooked capture (SLL), not Ethernet, so the real Ethernet header and any VLAN tag are not shown.

filternone

No filter: every packet on the interface is captured. Because it is unfiltered, expect a lot of output; add host/port/proto to narrow it.

verbose4

Verbosity 4: print header of packets with interface name. Interface names are shown (verbose 4-6).

count0

Packet count 0 means capture until you stop it with Ctrl+C. Set a number to auto-stop after that many packets.

timestampl

absolute local timestamp: yyyy-mm-dd hh:mm:ss.ms in the FortiGate's local time. Also safe for parallel captures.

Endpoint da APIGEThttps://ronutz.com/api/v1/fortios-sniffer-builderDocumentado, não servido. Abre a especificação.

Referências