Exam NSE8_811 topic 1 question 17 discussion

Correct: CD

Correct: CD To check arp list, sniffer to host and arp, "arp" its possible use in sniffer Example: FGT # diagnose sniffer packet port1 "host 221.142.61.32 and arp" 4 interfaces=[port1] filters=[host 221.142.61.32 and arp] 17.766400 port1 -- arp who-has 221.142.61.32 tell 221.142.61.32 No A, because its in same segment and using source address, device info nic, mmm only to know physical mac wan1

I would say C,D --- sniffer with arp flag is perfectly possible

Answer is A and C, B is wrong because that command give you conuters and nothing else https://docs.fortinet.com/document/fortigate/6.0.0/hardware-acceleration/90160/diagnose-hardware-deviceinfo-nic-interface-name-number-of-packets-dropped-by-an-interface D is incorrect because you need to use the following if need to see arp packets Match ARP packets only: # diagnose sniffer packet wan1 "ether proto 0x0806" https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Using-the-FortiOS-built-in-packet-sniffer/ta-p/194222

i'm thinking of B, to check hardware first (even though other 10.1.1.0/24 are reachable) and C, to check the ARP list

yes A is incorrect, as it specifies saddr.

C and D are most likely the right ones. A does not makes sense, using debug flow is usually to check outgoing policy or Natting behavior. in this case, we are still on the local network

C & D not more likely?