FortigateSniffer Abuse via FortiOS diagnose sniffer packet Command

Ibrahim Saud@tektrix

•updated Jul 3, 2026•3•0•5

Detects the use of the 'diagnose sniffer packet' command on FortiOS, or evidence of the FortigateSniffer tool (associated with past FortiGate vulnerabilities). This behavior is indicative of unauthorized packet capture and potential credential sniffing on network infrastructure devices.