NSE4 High Availability and Diagnostics Practice Question
An administrator wants to troubleshoot a traffic flow issue on a FortiGate. They suspect packets are being dropped. Which command should they use to perform a real-time packet capture on an interface?
⚠ Common exam trap
NSE4 often tests the distinction between packet capture tools (sniffer) and flow tracing tools (debug flow), causing candidates to confuse their specific purposes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
diagnose sniffer packet
The command 'diagnose sniffer packet' is used on FortiGate to perform real-time packet capture on an interface. It allows administrators to see packet details, including headers and payloads, to troubleshoot traffic flow issues and identify dropped packets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
diagnose sniffer packet
Why this is correct
diagnose sniffer packet is the standard FortiGate packet capture tool, analogous to tcpdump or Wireshark. It captures raw packets at the kernel level on specified interfaces or VLANs, displaying actual packet headers and payload in real time. This command is essential for analyzing the exact traffic content, checksums, and any malformed packets, making it the correct choice for troubleshooting traffic flow issues at Layer 2-4.
- ✗
get system performance status
Why it's wrong here
get system performance status provides a high-level overview of CPU, memory, and session counts, used for load monitoring and capacity planning. It does not show individual packets or their contents, nor does it reveal the path a specific flow took. This command is not a packet capture tool and cannot be used to inspect the actual data being transmitted.
- ✗
diagnose sys session list
Why it's wrong here
diagnose sys session list outputs the current session table, showing source/destination addresses, ports, and session state (e.g., TCP established, UDP timeout). It offers a static snapshot of session metadata but not the raw packets themselves, nor any payload details. While it helps verify whether a session exists and its state, it does not capture or display packet-level data.
- ✗
diagnose debug flow
Why it's wrong here
diagnose debug flow traces the logical processing of packets through the FortiGate's pipeline, recording policy hits, NAT translations, and session setup events. It is a powerful debugging tool for understanding how a firewall rule affects traffic, but it does not capture actual packet bytes or payloads. This command focuses on session flow logic rather than the content of the packets, so it is not a substitute for a packet sniffer.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 773 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator wants to monitor real-time traffic flows on a FortiGate, specifically to see packet details for traffic matching certain criteria. Which command should the administrator use to capture live packets on an interface?
easy- ✓ A.diagnose sniffer packet
- B.diagnose debug enable and diagnose debug flow trace
- C.diagnose sys session list
- D.execute system grep from CLI
Why A: The 'diagnose sniffer packet' command is FortiGate's built-in packet capture tool, allowing administrators to capture live packets on a specified interface with optional filters for host, port, and protocol. It provides real-time packet-level visibility similar to tcpdump, which is exactly what is needed to inspect packet details for traffic matching specific criteria.
Variation 2. Which FortiGate diagnostic command allows you to capture packets on an interface for troubleshooting network connectivity issues?
easy- A.diagnose debug flow
- ✓ B.diagnose sniffer packet
- C.diagnose sys session list
- D.diagnose test application
Why B: The 'diagnose sniffer packet' command on a FortiGate captures packets on a specified interface, similar to tcpdump. It allows administrators to see live packet data for troubleshooting connectivity, filtering by interface, protocol, host, port, and verbosity level. This is the correct tool for packet-level capture.
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.