Packet capture when FortiClient is active?

Anyone know how, on a Mac, to do a packet capture of traffic that would be traversing FortiClient VPN?  If I try to use the packet cap interface, or the tunnel interface (utun0) I get no packets, and obviously capturing on the 'real' interface just shows me ESP packets to the FortiGate.