This article describes the meaning of the message ‘protocol 0000 is buggy’ when the console login to FortiGate or SSH to run sniffer.
Scope
FortiGate.
Solution
The message ‘protocol 0000 is buggy’ prompts out once login in to the FortiGate using the console as shown below:
login: protocol 0000 is buggy, dev port1 Password: protocol 0000 is buggy, dev port1 Welcome! # protocol 0000 is buggy, dev port1 # cprotocol 0000 is buggy, dev port1 protocol 0000 is buggy, dev port1
It can be seen when running the sniffer to capture the packet as shown below:
filters=[host 213.131.235.69 and port 995] 0.709962 82.100.207.229.48380 -> 213.131.235.69.995: fin 2135298689 ack 3806954849 0.710563 213.131.235.69.995 -> 82.100.207.229.48380: fin 3806954849 ack 2135298690 0.741028 82.100.207.229.48380 -> 213.131.235.69.995: ack 3806954850 protocol 0000 is buggy, dev port4 protocol 0000 is buggy, dev port4
Followed by ‘dev port1’, ‘dev port4’, or whichever port number is not affecting the performance of the FortiGate, and there is no impact on the interfaces as well, the message is just an informational message printed from the kernel.