Description
This article explains how to add a filter to sniffer commands for the PPPoE interface in the FortiGate device for IPV4 and IPv6.
Scope
FortiGate.
Solution
- To filter sniffer commands for the PPPoE interface on a FortiGate device for IPv4 and IPv6, use the diag sniffer packet command with specific filters.
- For IPv4 traffic over PPPoE, use the following command to capture UDP packets, or specify source/destination IPs or ports as needed:
diagnose sniffer packet <interface_name> 'proto 17' 6 0 l
- The provided command facilitates detailed packet captures on a specified physical interface, focusing on PPPoE discovery (0x8863) and session (0x8864) stages, as outlined in RFC 2516.
- Using the filter 'ether proto 0x8863 or ether proto 0x8864' ensures only relevant PPPoE packets are captured, which is crucial for diagnosing connectivity issues or PPP session problems.
- Running the capture for extended periods, such as several hours, increases the likelihood of capturing transient issues.
- For precise command syntax, note that the 'l' at the end is a lowercase letter, indicating the capture length or specific options as per FortiOS documentation.
- Additional troubleshooting tips and best practices are available in the FortiOS packet sniffer guide, which can help refine filtering and analysis techniques for effective problem resolution.
diagnose sniffer packet <physical interface> 'ether proto 0x8863 or ether proto 0x8864' 6 0 l
- For IPv6, similarly, include the ip6 keyword. For example:
diagnose sniffer packet <interface_name> 'ip6' 6 0 l
- To focus on PPPoE traffic, filter by protocol number 0x8863 (PPPoE Discovery) or 0x8864 (PPPoE Session) in the filter expression, such as 'proto 0x8864'.
- Replace <interface_name> with the actual interface name associated with the PPPoE connection.
diagnose sniffer packet <interface> '<filter>' <level> <count> <tsformat>
- The 'diagnose sniffer packet' command is used to capture IPv6 packets on a specified interface, allowing for filtering with flexible logical expressions, such as source or destination addresses, ports, or protocols, like ICMPv6 or UDP.
- It is possible to specify the interface (e.g., any, wan1), set a filter string to narrow down the capture (e.g., host 2001:4860:4860::8888), and define the capture depth (level), number of packets (count), and timestamp format (tsformat).
- This tool is useful for diagnosing network issues, monitoring IPv6 traffic, and analyzing specific communication patterns, especially when troubleshooting complex IPv6 deployments.
