I want to run the fortigate packet sniffer: https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Using-the-FortiOS-built-in-packet-sniffer/ta-p/194222

and when I do so, I only get CLI Console output which is eventually lost...

How do I tell fortigate to dump this output to a file or syslog?

1 Answer 1


If you want the Fortigate to store anything locally, your Fortigate unit has to be a model that has local storage. Lighter models like the 30E and such can't do anything like that. To answer this question though it depends really on what you want

If you literally just want the sniffer output as it appears in the CLI console, then you don't need anything special to do that -- you should be able to just tell your terminal emulator to log the session to a local file on your workstation.

Here is how you could do that for PuTTY.

Here is how for SecureCRT.

If you're just connecting from a regular linux terminal, you can do that with tee.

Check the docs and/or search around to see how it's done for whatever particular terminal emulator you're using.

If you want the actual packets, you will need a unit with local storage, and it's a little convoluted to do it from CLI. There are some basic instructions in the cookbook however for how to do what it's capable of, but it's far easier to setup & run the sniffer from the web interface like this. That will get you a pcap file you can easily download from the same web GUI with everything in it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.