Packet capture filter on PPPoE interface

FortiGate

FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.

Article Id 305681

Description

This article specifically focuses on packet capture filters on PPPoE packets. It prevents capturing all traffic In/Out through PPPoE when there is an intermittent issue occurring on the PPPoE interface.

Scope

FortiGate.

Solution

The ethernet type is set to either 0x8863 (Discovery Stage) or 0x8864 (PPP Session Stage). Refer to https://www.rfc-editor.org/rfc/rfc2516.txt.
It is highly recommended to perform packet capture with filtered on the PPPoE interface. It can run for a few hours to wait for an issue recurrence.

diagnose sniffer packet <physical interface> 'ether proto 0x8863 or ether proto 0x8864' 6 0 l <----- l is small letter.

For more details on packet capture filter, refer to Troubleshooting Tip: Using the FortiOS built-in packet sniffer for capturing packets

1032

Broad. Integrated. Automated.

The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.

Technical Tip: Packet capture filter on PPPoE interface

You are leaving our website