If you want to see only packets on the interface port33 in both directions, you can use following Wireshark filter: The comments will look like: '(out) port33' or '(in) port34'. This can be then added as a column to the packet list and/or filtered by. The main benefit of this script compared to the old official one (besides the better speed) is that it includes the interface name and traffic direction in the packet comments. If you want different name for the PCAPng, use the -out parameter. Run sniftran with -in parameter specifying the text file with packetsįile with the same name and '.pcapng' suffix will be created. For FortiAuthenticator use: 'tcpdump -XXe -s0 -tt -ni.' with the parameter 6 (full packets with interface and data).

For FortiGate use: 'diag sniffer packet.Capture the plaintext packets into a text file.Ability to decode capture taken with FortiGate sniffer option '5'.Ability to decode captures on p2p (ppp) interfaces.

Ability to select only some interfaces to include from the capture (-include or -exclude parameters).

Automatically adds the interface name and traffic direction to PCAPng comments section.

Program to convert plain text traffic capture from FortiGate and other Fortinet appliances to PCAPng usable in Wireshark.

Fortigate packet capture wireshark