Technical Tip: How to capture VLAN (Virtual Local Area Networking) tagging (802.1q) packet in FortiGate

[caunon]

Description	This article describes how to capture VLAN (Virtual Local Area Networking) tagging (802.1q) packets to investigate the issue further in FortiGate or related situations.
Scope	FortiGate.
Solution	If there is a VLAN tagging (802.1q) issue at FortiGate where FortiGate may connect to a third-party device, and there are some VLAN issues with third-party devices, it is necessary to filter to investigate the issue further only with specific VLAN tagging (802.1q) packets. Consider using the following CLI commands to capture VLAN tagging (802.1q)  packets. It is possible to do it with CLI commands of the FortiGate via Telnet, SSH, or CLI Console on the GUI of FortiGate. At CLI command of FortiGate: FGT # diagnose sniffer packet any "ether proto 0x8100" 6 0 l or FGT # diagnose sniffer packet <interface name> "ether proto 0x8100" 6 0 l Example: FGT # diagnose sniffer packet any "ether proto 0x8100" 6 0 l interfaces=[any] filters=[ether proto 0x8100] 2022-09-15 15:45:50.985765 VlanTst10 -- 802.1Q vlan#10 P0 0x0000 B456 3659 1415 C645 1956 6465 8100 000a .jd.i..q..L..... 0x0010 0800 4500 0034 0000 4000 d406 c6e4 1515 ..E..4..@.....#R 0x0020 4545 9595 9595 01bb eb81 4baa a216 df05 .*...X....K..... 0x0030 b289 8012 6903 b990 0000 0204 05b4 0101 ....i........... 0x0040 0402 0103 0308 ...... 2022-09-15 15:45:50.987306 VlanTst10 -- 802.1Q vlan#10 P0 0x0000 C645 1956 6465 B456 3659 1415 8100 000a .q..L..jd.i..... 0x0010 0800 4500 0028 983f 4000 8006 82b1 9595 ..E..(.?@....... 0x0020 9595 1515 4545 eb81 01bb df05 b289 4baa .X#R.*........K. 0x0030 a217 5010 0402 5f65 0000 ..P..._e.. 2022-09-15 15:45:51.058182 VlanTst10 -- 802.1Q vlan#10 P0 0x0000 ffff ffff ffff 3956 2424 B654 8100 000a ......0.#R.C.... 0x0010 0800 4500 0024 50e9 0000 8011 c775 9595 ..E..$P......u.. 0x0020 9565 ffff ffff 1388 0f74 0010 7853 4211 .`.......t..xSB. 0x0030 0002 0000 0001 ...... From the GUI: The VLAN tag (802.1q) can also be seen in packet capture from the GUI. Go to Network-->Diagnostics --> Packet Capture. Select the appropriate interface and use the advanced filter 'ether proto 0x8100'. The VLAN ID can be seen when selecting one of the captured packets: Related articles: Technical Tip: Understanding DHCP Server and DHCP Relay functionality on FortiGate Troubleshooting Tip: Client receives the wrong DHCP scope Troubleshooting Tip: Check DHCP Messages with VLAN Tag using Wireshark Packet Capture