create_device_on_demand_sniffer
Create a bounded on-demand packet sniffer definition to stage a one-shot capture job with a packet count limit and filters for hosts, ports, and protocols.
Instructions
Create a bounded on-demand packet sniffer on a managed device.
Distinct FortiOS object from create_device_sniffer's firewall sniffer: this one (firewall on-demand-sniffer) is name-keyed
rather than id-keyed, and bounded by max_packet_count rather than
running continuously -- closer to a one-shot capture job than a
standing diagnostic rule. Filters are lists (multiple hosts/ports/
protocols at once), not the single range-string form the persistent
sniffer uses.
How to actually trigger the capture and retrieve packets once this definition exists is not part of FortiOS's Configuration API (this tool only stages the definition, config-CRUD like every other tool in this module) -- that would be a separate monitor-API or CLI mechanism, out of scope here.
Args: device: Managed device name name: On-demand sniffer name interface: Interface name traffic sniffing takes place on max_packet_count: Maximum packets to capture (default: 4000) hosts: IPv4/IPv6 hosts to filter for ports: Ports to filter for (each 1-65535) protocols: IANA protocol numbers to filter for (each 0-255) capture_non_ip: Include non-IP packets (default: False) vdom: VDOM the sniffer lives in (default "root")
Returns: Creation result
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | ||
| vdom | No | root | |
| hosts | No | ||
| ports | No | ||
| device | Yes | ||
| interface | Yes | ||
| protocols | No | ||
| capture_non_ip | No | ||
| max_packet_count | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||