To display only the traffic between two hosts, specify the IP addresses of both hosts. Type either none to capture all packets, or type a filter that specifies which protocols and port numbers that you do or do not want to capture, such as 'tcp port 25'.

Type the name of a network interface whose packets you want to capture, such as port1, or type any to capture packets on all network interfaces. To minimize the performance impact on your FortiAnalyzer unit, use packet capture only during periods of minimal traffic, with a serial console CLI connection rather than a Telnet or SSH CLI connection, and be sure to stop the command when you are finished. Packet capture can be very resource intensive. Packet capture output is printed to your CLI display until you stop it by pressing CTRL + C, or until it reaches the number of packets that you have specified to capture. Packet capture is displayed on the CLI, which you may be able to save to a file for later analysis, depending on your CLI client. Packet capture on FortiAnalyzer units is similar to that of FortiGate units. By recording packets, you can trace connection states to the exact point at which they fail, which may help you to diagnose some types of problems that are otherwise difficult to detect.įortiAnalyzer units have a built-in sniffer. Packet capture, also known as sniffing, records some or all of the packets seen by a network interface. Use this command to perform a packet trace on one or more network interfaces.

Fortiwifi 60d packet capture tool