Fortigate Hidden drops

#!/bin/bash
# Patrick Marc Preuss (c)2021 - 2025

# Check for required environment variable
if [ -z "${SSHPASS}" ]; then
    echo "Error: Please set the SSHPASS environment variable."
    exit 127
fi

# Check for firewall argument
FW="$1"
if [ -z "${FW}" ]; then
    echo "Usage: $0 <firewall-hostname-or-IP>"
    exit 127
fi

# Timestamp for output file
DATE=$(date +"%Y-%m-%dT%H_%M_%S")
OUTPUT="${FW}-${DATE}-diag-outputs.txt"

# Optional: Limit number of loops (set to 0 for infinite)
MAX_LOOPS=10
COUNT=0

# Trap for graceful exit
trap "echo 'Interrupted. Exiting...'; exit 0" SIGINT SIGTERM

# Diagnostic command function
run_diagnostics() {
    echo "a"
    echo "config global"
    echo "exec date"
    echo "exec time"
    echo "exec tac report"
    echo "get system status"
    echo "get system ha status"
    echo "exec date"
    echo "exec time"

    echo "exec time"
    echo "get system status"
    echo "get system performance status"
    echo "diag sys session stat"
    echo "sudo root diag firewall packet distribution"
    echo "diagnose hardware deviceinfo nic port31"
    echo "diagnose hardware deviceinfo nic port32"
    for i in {0..3}; do
        echo "diagnose npu np6 dce $i"
        echo "diag npu np6 anomaly-drop $i"
        echo "diag npu np6 hrx-drop $i"
        echo "diag npu np6 pdq $i"
        echo "fnsysctl cat /proc/net/np6_${i}/int-link"
        echo "fnsysctl cat /proc/net/np6_${i}/hif-que"
        echo "fnsysctl cat /proc/net/np6_${i}/hif-stats"
    done
}

# Main loop
(
    while [ "$MAX_LOOPS" -eq 0 ] || [ "$COUNT" -lt "$MAX_LOOPS" ]; do
        run_diagnostics
        sleep 120
        COUNT=$((COUNT + 1))
    done
) | sshpass -e ssh -t -t -o StrictHostKeyChecking=no "${FW}" > "${OUTPUT}"

echo "Diagnostics complete. Output saved to ${OUTPUT}"