I have a Fortigate 800C in Flow based inspection and configured one-arm sniffer mode on an interface and configured a firewall sniffer with below config

config firewall sniffer
  set ips-sensore-status enable
  set ips-sensor sniffer-profile
  set logtraffic all
  set interface port9
  set status enable

But, i am not able to see the packet info/data on Log&Report->sniffer Traffic Page on Fortigate UI. Can anyone check/let me know is there any config/setting required on fortigate for it to work in sniffer mode for IDS...?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Dec 15 '19 at 2:40
Configure sniffer.
        set id {integer}   Sniffer ID. range[0-9999]
        set status {enable | disable}   Enable/disable the active status of the sniffer.
        set logtraffic {all | utm | disable}   Either log all sessions, only sessions that have a security profile applied, or disable all logging for this policy.
                all      Log all sessions accepted or denied by this policy.
                utm      Log traffic that has a security profile applied to it.
                disable  Disable all logging for this policy.
        set ipv6 {enable | disable}   Enable/disable sniffing IPv6 packets.
        set non-ip {enable | disable}   Enable/disable sniffing non-IP packets.
        set interface {string}   Interface name that traffic sniffing will take place on. size[35] - datasource(s): system.interface.name
        set host {string}   Hosts to filter for in sniffer traffic (Format examples:,,, size[63]
        set port {string}   Ports to sniff (Format examples: 10, :20, 30:40, 50-, 100-200). size[63]
        set protocol {string}   Integer value for the protocol type as defined by IANA (0 - 255). size[63]
        set vlan {string}   List of VLANs to sniff. size[63]
        set application-list-status {enable | disable}   Enable/disable application control profile.
        set application-list {string}   Name of an existing application list. size[35] - datasource(s): application.list.name
        set ips-sensor-status {enable | disable}   Enable/disable IPS sensor.
        set ips-sensor {string}   Name of an existing IPS sensor. size[35] - datasource(s): ips.sensor.name
        set dsri {enable | disable}   Enable/disable DSRI.
        set av-profile-status {enable | disable}   Enable/disable antivirus profile.
        set av-profile {string}   Name of an existing antivirus profile. size[35] - datasource(s): antivirus.profile.name
        set webfilter-profile-status {enable | disable}   Enable/disable web filter profile.
        set webfilter-profile {string}   Name of an existing web filter profile. size[35] - datasource(s): webfilter.profile.name
        set spamfilter-profile-status {enable | disable}   Enable/disable spam filter.
        set spamfilter-profile {string}   Name of an existing spam filter profile. size[35] - datasource(s): spamfilter.profile.name
        set dlp-sensor-status {enable | disable}   Enable/disable DLP sensor.
        set dlp-sensor {string}   Name of an existing DLP sensor. size[35] - datasource(s): dlp.sensor.name
        set ips-dos-status {enable | disable}   Enable/disable IPS DoS anomaly detection.

You can use this link for trouble shooting click here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.