Hint: Below is the format that Technical Support will usually request when attempting to analyze a problem as it includes full packet content, as well as absolute time stamp, in order to correlate packets with other system events.Īs already mentioned, diag sniffer includes a powerful filter functionality that will be described here. Use of absolute time stamp in sniffer trace will report the absolute system time (no time zone) in packet summary: Verbose 6, finally, even includes Ethernet (Ether Frame) Information.Ī Perl script is available below (.zip), or a Window executable if you don't have a Perl interpreter installed (fgt2eth.exe.12.2014.zip), which will convert a captured verbose 6 output, into a file that can be read and decoded by Ethereal/Wireshark. Notice the in/out parameter after the wan1 interface that will confirm the direction of the packet entering or leaving the interface. In this case, turn off the offloading in the policy that matches the traffic with 'set auto-asic-offload disable' for troubleshooting purposes only, and revert to the initial state after the capture. Note: in certain cases, where the unit has the capability and the session can be handled by a dedicated processor, the session is offloaded from the kernel, making it impossible to capture these packets. Note: for parallel captures on multiple interfaces/SSH sessions on FortiGate, use 'a' or 'l', do not leave it blank. (blank/no letter) – relative to the beginning of the capture L - (small letter L) timestamps the packets with LOCAL time on the unit the number of packets the sniffer reads before stopping.Ī – timestamps the packets with the absolute UTC time means the level of verbosity as described already is a very powerful filter functionality which will be described in more detail Can be an interface name or 'any' for all interfaces

Wireshark ip sniffer