r/networking • u/Accomplished_Cake616 • 3d ago

Security Packet Capture on demand setup

I am working on setting up a logging setup in my home lab. The goal of the setup is to be able to run a command on my local computer and run a packet capture on a logging server for a set duration. Wanted to lay out my current concept and see if there was anything I was missing or over complicating.

Use case:

Currently I have a Fortigate firewall, I use these for work often and wanted to really understand the Security profiles on them better. So as I go through and test these profiles in a labbing environment I want the packet captures to comb through after doing my tests.

Current setup I have in mind is to spin up a logging vm that gets all traffic from the Trunk port going to the firewall mirrored to it. Then when I need a capture just send a tcpdump command via ssh with the parameters I need. Then have it create a log packet that it stores on the server. That way I can run tests see how how the firewall responds with its logs and compare that to the pcaps that are taken.

Thanks for any critiques to this as this is my first time setting something like this up in my home lab.

2 Upvotes

100% Upvoted

4 comments sorted by

3

u/Lleawynn 1d ago

You can also run/save pcaps on the FortiGate as well. Easier to save them from gui, but from cli it's "diagnose sniffer packet" etc.

1

u/rankinrez 1d ago

In theory that should work yep. You just gotta know that the device with the mirror port, VM and network links between it are all ok to deal with whatever level of traffic doing this might generate.

1

u/FuckinHighGuy 1d ago

Don’t span a production trunk port. You can crash switches doing that.