Troubleshooting
Page 141
FortiRecorder 2.4.2 Administration Guide
9.
Press Enter to send the CLI command to the FortiRecorder appliance, beginning packet
capture.
10.
If you have not specified a number of packets to capture, when you have captured all
packets that you want to analyze, press Ctrl + C to stop the capture.
11.
Close the PuTTY window.
12.
Open the packet capture file using a plain text editor such as Notepad.
13.
Delete the first and last lines, which look like this:
=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2016.07.25 11:34:40
=~=~=~=~=~=~=~=~=~=~=~=
FortiRecorder-200 #
These lines are a PuTTY timestamp and a command prompt, which are not part of the
packet capture. If you do not delete them, they could interfere with the script in the next
step.
14.
Convert the plain text file to a format recognizable by your network protocol analyzer
application.
You can convert the plain text file to a format (.pcap) recognizable by Wireshark (formerly
called Ethereal) using the fgt2eth.pl Perl script. To download fgt2eth.pl, see the Fortinet
Knowledge Base article
Using the FortiOS built-in packet sniffer
.
To use fgt2eth.pl, open a command prompt, then enter a command such as the following:
fgt2eth.pl -in packet_capture.txt -out packet_capture.pcap
where:
•
fgt2eth.pl
is the name of the conversion script; include the path relative to the current
directory, which is indicated by the command prompt
•
packet_capture.txt
is the name of the packet capture’s output file; include the
directory path relative to your current directory
•
packet_capture.pcap
is the name of the conversion script’s output file; include the
directory path relative to your current directory where you want the converted output to
be saved
The fgt2eth.pl script is provided as-is, without any implied warranty or technical support, and
requires that you first install a Perl module compatible with your operating system.
Methods to open a command prompt vary by operating system.
On Windows XP, go to
Start > Run
and enter
cmd
.
On Windows 7, click the Start (Windows logo) menu to open it, then enter
cmd
.
