An administrator is using the FortiGate built-in sniffer to capture HTTP traffic between a client and a server, however, the sniffer output shows only the packets related with TCP session setups and…

Running the sniffer on only the internal interface would simply limit the capture to that interface but would still show data packets if they were processed by the CPU and not offloaded.

Even if a sniffer filter only captured traffic in one direction, it would still show data packets for that direction if they were processed by the CPU, not just session setup/teardown.

Content inspection (like proxy-based UTM) is performed by the FortiGate's CPU, which would actually make the traffic more visible to a software sniffer, not less.

When TCP traffic is offloaded to a Network Processor (NP6), the main CPU no longer processes the data packets, causing the built-in software sniffer to only capture the initial session setup and final teardown packets handled by the CPU.