Use the following command:
diagnose sniffer packet port1 "ether[12:2] <= 1500 and ether[14] != 0xaa" 6 100 a
Replace 'portx' with the specific port necessary to check that the LLC frames are passing through.
Notes:
Using the prefix 'ether' checks the frame header, whereas the prefix 'ip' checks the packet header. '12:2' indicate that FortiGate checks the thirteenth and fourteenth byte of the frame header. '<= 1500' refers to the length of the frames. With '>= 1536', only Ethernet II frames are captured (when the Ether type is specified). 'ether[14] != 0xaa' excludes SNAP frames. It is an IEEE 802.2 LLC extension to encapsulate other protocols like IPv4 which are usually managed with Ethernet II frames. No ether type associated with a single protocol exists for LLC frames, as it is a field of Ethernet II frames.
It may be useful to capture LLC frames to capture ARP and/or STP frames.
If LLC frames are received from FortiGate chassis models (usually 6K and 7K models) running a FortiOS firmware version between 7.6.4 and the 7.6.6, a bug may cause the unit to enter conserve mode. This issue is tracked with Bug ID 1242828, indicated here: Known issues.
The bug does not affect other major and minor FortiOS releases or other models, and it has been fixed in FortiOS versions 7.6.7 and above.
Further reading:
| 
