ondrejholecek / sniftran

Fortinet packet sniffer convertor

SnifTran

Program to convert plain text traffic capture from FortiGate and other Fortinet appliances to PCAPng usable in Wireshark.

Features

• Automatically adds the interface name and traffic direction to PCAPng comments section.
• Ability to select only some interfaces to include from the capture (--include or --exclude parameters)
• Ability to decode captures on p2p (ppp) interfaces
• Ability to decode capture taken with FortiGate sniffer option "5"

Usage

1. Capture the plaintext packets into a text file

• For FortiGate use: "diag sniffer packet ..." with the parameter 6 (full packets with interface and data).
• For FortiAuthenticator use: "tcpdump -XXe -s0 -tt -ni ..."

2. Run sniftran with --in parameter specifying the text file with packets

3. File with the same name and ".pcapng" suffix will be created. If you want different name for the PCAPng, use the --out parameter.

Wireshark

The main benefit of this script compared to the old official one (besides the better speed) is that it includes the interface name and traffic direction in the packet comments. This can be then added as a column to the packet list and/or filtered by.

The comments will look like: "(out) port33" or "(in) port34". If you want to see only packets on the interface port33 in both directions, you can use following Wireshark filter:

frame.comment contains "port33"

Binaries

The Binaries directory contains the "binaries" for Windows/Linux/MacOS and a new one can created by running "make" in the target platform (pyinstaller is needed).

However, be aware that these are not really binaries, but rather the executables containing the Python interpreter and the bytecode. It may still be necessary to have the right Python version installed in your environment.

Other parameters

$ ./sniftran.py -h

===
=== SnifTran - written by Ondrej Holecek <ondrej at holecek dot eu>
===

usage: ./sniftran.py --in <inputfile> [optional_parameters...]

   mandatory parameters:
    --in <inputfile>                   ... text file with captured packets, "-in" can be used for compatability

   optional parameters:
    --out <outputfile>                 ... name of the output pcap file, by default <inputfile>.pcapng
    --no-overwrite                     ... do not overwrite the output file if it already exists
    --no-compat                        ... disable the compatability with new FE and FAC sniffers outputs
    --skip <number>                    ... skip first <number> packets
    --limit <number>                   ... save only <number> packets
    --no-checks                        ... disable packet integrity checks
    --no-normalize-lines               ... do not try to normalize packet lines before parsing them
    --no-wireshark-ipsec               ... do not update Wireshark config file with found IPSec tunnels
    --include <interface>              ... save only packets from/to this interface (can be used multiple times)
    --exclude <interface>              ... ignore packets from/to this interface (can be used multiple times)
    --p2p <interface>                  ... mark interface as point-to-point, will try to correctly remove artifical ethernet header
    --nolink <interface>               ... for this interface, do not expect any link layer information (for sniffer with parameter 5)

   pcapng parameters:
    --section-size <number>            ... amount if packets in one SHB, default unlimited (Wireshark does not support anything else!)
    --max-packets <count>              ... maximum amount of packets in one pcapng file, writes multiple files if neceesary

   debug options:
    --debug <level>                    ... enable debug on specified level (1 - ?)
    --show-packets                     ... prints binary content of each packet and additional info (timestamp, interface, ...)
    --show-timestamps                  ... for performance test, show timestamp before each main operation block
    --stop-on-error                    ... raise an exception when packet parsing error occurres
    --include-packet-line              ... inserts the first line in the original file where the packet was found
    --progress                         ... show progress when parsing and assembling packets, be aware of small speed penalty

notes:
   FortiGate           - "diagnose sniffer packet ..." must be run with level 6
                       - if there are issues with considering also non-packet lines, disable FE & FAC compatibility mode
   FortiMail           - with compatibility mode (default) even the new format is recognized
   FortiAuthenticator  - command to collect packets must be "tcpdump -XXe -s0 -tt -ni <interface> <filter>..."

sniftran's Issues

Rebuild of binaries failed

Binaries folders and files time states 4y old.
And so I guessed that 892ba19 "support packet prefixes like "[FIM01]" that are generated by 6k7k blades" is not incorporated into existing binaries here.
Tried to make those binaries for myself, but it ended with following error:

`xsilver@SILVERSTONE:sniftran-master $make
pyinstaller --onefile sniftran.py
70 INFO: PyInstaller: 5.3
70 INFO: Python: 3.8.10
84 INFO: Platform: Linux-4.4.0-19041-Microsoft-x86_64-with-glibc2.29
85 INFO: wrote /home/xsilver/tempik/sniftran-master/sniftran.spec
97 INFO: UPX is not available.
101 INFO: Extending PYTHONPATH with paths
['/home/xsilver/tempik/sniftran-master']
535 INFO: checking Analysis
536 INFO: Building Analysis because Analysis-00.toc is non existent
536 INFO: Initializing module dependency graph...
538 INFO: Caching module graph hooks...
547 INFO: Analyzing base_library.zip ...
3643 INFO: Processing pre-find module path hook distutils from '/home/xsilver/.local/lib/python3.8/site-packages/PyInstaller/hooks/pre_find_module_path/hook-distutils.py'.
3645 INFO: distutils: retargeting to non-venv dir '/usr/lib/python3.8'
6297 INFO: Caching module dependency graph...
6429 INFO: running Analysis Analysis-00.toc
6582 INFO: Analyzing /home/xsilver/tempik/sniftran-master/sniftran.py

Syntax error in /home/xsilver/tempik/sniftran-master/sniftran.py
File "/home/xsilver/tempik/sniftran-master/sniftran.py", line 198
print "WARNING: cannot recognize time format"
^
SyntaxError: Missing parentheses in call to 'print'. Did you mean print("WARNING: cannot recognize time format")?

make: *** [Makefile:10: sniftran] Error 1`