Sniffed packet counts appear different

[#1]

Article

Description	When sniffing the internal and external ports, the packet count is different when it should be the same.
Components	All FortiGate units.
Steps or Commands	When sniffing the Internal port (diagnose sniff packet internal 'port 7788' 3), the following is returned: interfaces=[internal] filters=[port 7788] pcap_lookupnet: internal: no IPv4 address assigned 38.526132 1.1.1.9.56769 -> 1.1.1.55.7788: syn 3123466405 0x0000 0014 2a11 0c96 0011 2547 44f4 0800 4500 ..*.....%GD...E. 0x0010 002c 727b 0000 3a06 0a10 0101 0109 0101 .,r{..:......... 0x0020 0137 ddc1 1e6c ba2c 50a5 0000 0000 6002 .7...l.,P.....`. 0x0030 ffff 8ce5 0000 0204 05b4 0000 ............ There are total 60 bytes, the last two bytes are 0000. When sniffing the External port (diagnose sniff packet wan1 'port 7788' 3), the following is returned: interfaces=[wan1] filters=[port 7788] pcap_lookupnet: wan1: no IPv4 address assigned 3.336465 1.1.1.9.56769 -> 1.1.1.55.7788: syn 3123466405 0x0000 0014 2a11 0c96 0011 2547 44f4 0800 4500 ..*.....%GD...E. 0x0010 002c 727b 0000 3a06 0a10 0101 0109 0101 .,r{..:......... 0x0020 0137 ddc1 1e6c ba2c 50a5 0000 0000 6002 .7...l.,P.....`. 0x0030 ffff 8ce5 0000 0204 05b4 .......... In this case, there are total 58 bytes, the last two bytes 0000 are lost. The two bytes 0000 is right the trailer for padding in the packet. This is normal behavior. On ingress, the sniffer sees the packet before the padding has been stripped. On egress, the sniffer sees the packet before it goes to the hardware and so before any additional padding is added. The stack looks like: TCP -- IP -- device -- driver -- hardware Outbound packets flow from left to right, and inbound packets flow right to left. The sniff is taken at the device layer for both ingress and egress. It is the IP (firewall) layer that strips padding on ingress. It is the hardware that adds padding on egress. Since it is the hardware that adds padding there is no way to make the sniffer show that padding on egress since it does not get added until after the sniff is taken and it is physically impossible to take the sniff after the packet has been sent to the hardware.