Skip to main content
duenlim
Staff
duenlim
Staff
Mar 21, 2024 6:35 AM UTC

Technical Tip: Packet capture filter on PPPoE interface

Description This article specifically focuses on packet capture filters on PPPoE packets. It prevents capturing all traffic In/Out through PPPoE when there is an intermittent issue occurring on the PPPoE interface.
Scope FortiGate.
Solution
  1. The ethernet type is set to either 0x8863 (Discovery Stage) or 0x8864 (PPP Session Stage). Refer to https://www.rfc-editor.org/rfc/rfc2516.txt.
  2. It is highly recommended to perform packet capture with filtered on the PPPoE interface. It can run for a few hours to wait for an issue recurrence.

 

diagnose sniffer packet <physical interface> 'ether proto 0x8863 or ether proto 0x8864' 6 0 l    <----- l is small letter.

 

For more details on packet capture filter, refer to Troubleshooting Tip: Using the FortiOS built-in packet sniffer for capturing packets
    Terms & ConditionsAccessibility statement
    Risk and Resilience in the Age of AI. An OT Thought Leadership Summit for Houston's Critical Infrastructure Leaders. Date: Thursday, December 3, 2026. Time: 8:30 am - 1:30 pm (CT). Location: The Westin Houston, Memorial City | 945 Gessner Road, Houston, TX 77024