Description
filter "none" can be used to capture 802.1q tagging on Fortigate.
Solution
FGT60C# diagnose sniffer packet internal1 "none" 6 0 a
interfaces=[internal1]
filters=[none]
pcap_lookupnet: internal1: no IPv4 address assigned
2013-10-09 05:30:32.550259 internal1 -- 802.1Q vlan#3912 P0
0x0000 0009 0fd1 583e 0009 0fdf 22d0 8100 0f48 ....X>...."....H
0x0010 0800 4500 004c 445f 0000 3e11 173a 0a03 ..E..LD_..>..:..
0x0020 8265 0a0f 8a91 007b 007b 0038 9b02 2403 .e.....{.{.8..$.
0x0030 04fa 0000 3791 0000 0c97 80e9 9af5 d5ff ....7...........
0x0040 650b df67 7ed3 d5ff 68a0 6200 0863 d5ff e..g~...h.b..c..
0x0050 68a0 4ab7 fe08 d5ff 68a0 4abb 6672 h.J.....h.J.fr
2013-10-09 05:30:32.551033 internal1 -- 802.1Q vlan#3912 P0
0x0000 0009 0fd1 583e 0009 0fdf 22d0 8100 0f48 ....X>...."....H
0x0010 0800 4500 004c 4460 0000 3e11 1739 0a03 ..E..LD`..>..9..
0x0020 8265 0a0f 8a91 007b 007b 0038 c921 2403 .e.....{.{.8.!$.
0x0030 04fa 0000 3791 0000 0c97 80e9 9af5 d5ff ....7...........
0x0040 650b df67 7ed3 d5ff 68a0 6238 21af d5ff e..g~...h.b8!...
0x0050 68a0 4ae5 de15 d5ff 68a0 4ae7 3e68 h.J.....h.J.>h
2013-10-09 05:30:32.551739 internal1 -- 802.1Q vlan#3912 P0
0x0000 0009 0fd1 583e 0009 0fdf 22d0 8100 0f48 ....X>...."....H
0x0010 0800 4500 004c 4461 0000 3e11 1738 0a03 ..E..LDa..>..8..
0x0020 8265 0a0f 8a91 007b 007b 0038 813d 2403 .e.....{.{.8.=$.
0x0030 04fa 0000 3791 0000 0c97 80e9 9af5 d5ff ....7...........
0x0040 650b df67 7ed3 d5ff 68a0 6268 c261 d5ff e..g~...h.bh.a..
0x0050 68a0 4b14 b9cb d5ff 68a0 4b16 0956 h.K.....h.K..V
