I have a fortigate 40F with an lan1 to lan4 configured as an hardware switch (lan).

I would like to capture switched traffic between hosts, even if it's not in the same IP subnet than the lan configuration.

I have tried

diagnose sniffer packet lan 

but it only return broadcast STP trafic

1.4294199540 BPDU 'lan2' stp 802.1w, rapid stp, flags [proposal, agreement], bridge-id 8000....
1.4294199560 BPDU 'lan1' stp 802.1w, rapid stp, flags

When I specify a physical interface, it return nothing since there is no ip addres assigned:

diagnose sniffer packet lan1
pcap_lookupnet: lan1: no IPv4 address assigned

I've tried to enable ips-sniffer-mode but didn't changed anything

config system interface
    edit lan
        set ips-sniffer-mode enable
  • I used to do that on the GUI, but I think you need to specify the switch group, not a physical interface.
    – Zac67
    Jun 14 at 10:36
  • Thank you, I think I already tried that but maybe some settings were wrong.
    – Golgot
    Jun 15 at 20:49


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.