FortiGate diagnose sniffer packet

Overview

diagnose sniffer packet is FortiOS's built-in packet capture command. It is one of the fastest ways to determine whether traffic is reaching a FortiGate, which interface it arrives on, and whether it leaves on the expected interface.

Unlike debug flow, a packet sniffer shows observed packets rather than FortiOS policy-processing decisions. The two tools complement each other.

Syntax

diagnose sniffer packet <interface> '<filter>' <verbose> <count> <timestamp-format> <frame-size>

The frame-size parameter is optional in common use.

A typical operational form is:

diagnose sniffer packet any 'host 10.1.10.20' 4 0 l

Parameters

Interface

Use a specific interface when you already know where traffic should appear:

diagnose sniffer packet wan1 'host 8.8.8.8' 4 20 l

Use any when determining the path across interfaces:

diagnose sniffer packet any 'host 10.1.10.20' 4 0 l

Filter

The filter supports tcpdump-style expressions.

Examples:

'host 10.1.10.20'

'src host 10.1.10.20 and dst host 10.2.20.10'

'host 10.1.10.20 and port 443'

'icmp and host 10.1.10.20'

'udp and port 53'

Verbosity

Fortinet documents verbosity levels from 1 through 6.

For day-to-day path troubleshooting, level 4 is especially useful because it prints packet headers and interface names.

Higher levels include packet payload data and can expose sensitive information. Use them only when required.

Count

Use a finite count where possible:

diagnose sniffer packet any 'host 10.1.10.20' 4 100 l

A count of 0 keeps the capture running until manually stopped.

Timestamp format

l displays local absolute timestamps and is useful when correlating the capture with logs or user reports.

When to use it

Use the sniffer to answer questions such as:

• Does the FortiGate receive the packet?
• Which interface receives it?
• Does the packet leave another interface?
• Is there return traffic?
• Is DNS traffic actually being sent?
• Is a VPN packet entering and leaving the tunnel?
• Is an endpoint retransmitting because no reply arrives?

Example: host connectivity

diagnose sniffer packet any 'host 10.1.10.20' 4 0 l

Then reproduce the problem from 10.1.10.20.

A healthy routed exchange can show traffic entering one interface and leaving another, followed by the reply in the reverse direction.

Example: HTTPS only

diagnose sniffer packet any 'host 10.1.10.20 and tcp port 443' 4 100 l

This is more useful than capturing all traffic from the host when the reported issue is specifically HTTPS.

Example: DNS troubleshooting

diagnose sniffer packet any 'host 10.1.10.20 and port 53' 4 100 l

Look for the query and a corresponding reply.

How to interpret common patterns

Packet enters but does not leave

This indicates that the FortiGate saw the traffic, but does not by itself identify the reason it was not forwarded.

Next steps typically include:

• Check routing.
• Check firewall policy.
• Check policy route / SD-WAN selection.
• Run debug flow.

Packet enters and leaves, but no reply returns

The FortiGate has forwarded the traffic. Investigate the downstream path, destination host, remote firewall, service state, or return routing.

Request and reply both cross the FortiGate

The network path through the FortiGate is likely functioning for that captured exchange. Continue troubleshooting at the client, server, or application layer.

Nothing appears

Possible causes include:

• The client is not generating the expected traffic.
• The filter is wrong.
• The wrong VDOM or interface is being inspected.
• The packet never reaches the FortiGate.

Validation

A useful capture should establish the observed direction and path of a test flow.

Before closing the capture, record:

• Source IP
• Destination IP
• Protocol / port
• Ingress interface
• Egress interface, if present
• Whether return traffic appears
• Timestamp of the test

Risks and considerations

Packet sniffing is normally low risk, but operational discipline is still required.

Sensitive data

High verbosity can print packet contents. Avoid capturing credentials or application payloads unless absolutely necessary and authorized.

High-volume captures

Broad filters on high-throughput interfaces can produce excessive terminal output and make the evidence difficult to interpret.

Use the narrowest useful filter.

Stop

Press:

CTRL+C

to stop an unlimited sniffer session.

Relationship with debug flow

Use packet sniffer when the question is:

Did the FortiGate see or forward this packet?

Use debug flow when the question is:

Why did FortiOS make this forwarding, policy, NAT, or drop decision?

In difficult cases, use both.

Related articles

• FortiGate debug flow
• FortiGate routing table
• FortiGate IPsec tunnel established but no traffic

Sources

See the authoritative Fortinet references in the article metadata.