Fortinet FortiRecorder 400D, Administration Manual

Page: 139 / 169

Troubleshooting Page 139 FortiRecorder 2.4.2 Administration Guide
•
5
— All of the output from
2
, plus the network interface name. e.g.:
•
6
— All of the output from
3
, plus the network interface name. e.g.:
For example, you might capture all TCP port 443 (typically HTTPS) traffic occurring through
port1, regardless of its source or destination IP address. The capture uses a high level of
verbosity (indicated by
3
).
A specific number of packets to capture is not specified. As a result, the packet capture
continues until the administrator presses Ctrl+C. The sniffer then confirms that five packets
were seen by that network interface.
(Verbose output can be very long. As a result, output shown below is truncated after only one
packet.)
FortiRecorder# diagnose sniffer packet port1 'tcp port 443' 3
interfaces=[port1]
filters=[tcp port 443]
10.651905 192.168.0.1.50242 -> 192.168.0.2.443: syn 761714898
0x0000 0009 0f09 0001 0009 0f89 2914 0800 4500
..........)...E.
0x0010 003c 73d1 4000 4006 3bc6 d157 fede ac16
.<s.@.@.;..W....
0x0020 0ed8 c442 01bb 2d66 d8d2 0000 0000 a002
...B..-f........
0x0030 16d0 4f72 0000 0204 05b4 0402 080a 03ab
..Or............
0x0040 86bb 0000 0000 0103 0303 ..........
Instead of reading packet capture output directly in your CLI display, you usually should save
the output to a plain text file using your CLI client. Saving the output provides several
advantages. Packets can arrive more rapidly than you may be able to read them in the buffer of
your CLI display, and many protocols transfer data using encodings other than US-ASCII. It is
interfaces=[port2]
filters=[none]
0.508965 port2 -- 172.20.130.16.2265 -> 172.20.130.15.42575: udp 44
0x0000 4500 0048 03ab 4000 4011 dab1 ac14 8210 E..H..@.@.......
0x0010 ac14 820f 08d9 a64f 0034 df2e 80c8 0006 .......O.4......
0x0020 38fa 3fd8 d39f 1ee5 7597 80ba 75f0 bb05 8.?.....u...u...
0x0030 0000 3064 0831 856b 81ca 0003 38fa 3fd8 ..0d.1.k....8.?.
0x0040 0105 6c6f 6262 7900 ..lobby.
interfaces=[port2]
filters=[none]
0.169046 port2 -- 172.20.130.16.2268 -> 172.20.130.15.35552: udp 46
0x0000 50e5 49e8 dc3d 000f 7c08 2ff5 0800 4500 P.I..=..|./...E.
0x0010 004a 8989 4000 4011 54d1 ac14 8210 ac14 .J..@.@.T.......
0x0020 820f 08dc 8ae0 0036 43eb 80e0 590e 5ad4 .......6C...Y.Z.
0x0030 6e1a 53b4 db17 419b d006 02bd e02d f92e n.S...A......-..
0x0040 f809 35ac 020e f4a0 3ac4 7097 7cd9 01b3 ..5.....:.p.|...
0x0050 cdd5 42dc 9e6c 0ec0 ..B..l..