Plink.exe -ssh -i rsakey.ppk 'diagnose sniffer packet any 'not port 22' 3' > capture.txt Paste or type the 2 lines of commands below on separated windows. Option 4 - Connect using the plink tool and RSA keys.

Plink.exe -ssh -batch -pw yourpassword 'diagnose sniffer packet any 'not port 22' 3' > capture.txt | fgt2eth.exe -in capture.txt -out. Option 3 - Connect using one of the putty tools called plink.exe. The capture will only start when the RSA password is typed, so the ssh connection can be made. (echo diagnose sniffer packet any 'not port 22' 3 ) | ssh -i rsakey.ppk -tt > capture.txt | fgt2eth.exe -in capture.txt -out. Option 2 - Connect using Windows 10 Native ssh client and RSA keys. The capture will only start when the admin password is typed, so the ssh connection can be made. (echo diagnose sniffer packet any 'not port 22' 3 ) | ssh > capture.txt | fgt2eth.exe -in capture.txt -out. Open an MS-DOS Command prompt and make sure the c: ools or the folder in which files were saved previously is chosen.

plink.exe ssh 1 - Connect using Windows 10 Native ssh client.

This step is required 1 time only per Fortigate.

Run the commands for the 1st time to accept and add the ssh fingerprint.

ppk file to c: ools to simplify the commands.

Configure and deploy ssh RSA keys (optional) - Save.

Download plink.exe if one doesn't wants to use the Windows native ssh client (optional) Save it to a local folder like c: ools for example.

Save it to a local folder like c: ools for example.

Download fgt2eth.12.2014.exe and rename it to fgt2eth.exe.The commands below use SSH to connect to the FortiGate back-end and send the sniffer command piping the output to a local file which must be converted using the fgt2eth tool before being sent to Wireshark in the right format.Īlthough this technique is quite simple to use, pre-configure the environment is needed by following the steps below: & ! article demonstrates how to send 'diagnose sniffer packet' output directly to Wireshark for real-time capture and troubleshooting purposes on Windows 10. Ip.addr = 10.0.0.0/24 įrame contains traffic

Wireshark commands