Wednesday, 15 July 2026

Fortigate GUI Packet capture for MAC OUI

 Create the capture under the interface that you wish (or use any) and add the following advanced filter replacing the 'aaaaaa' with the vendor OUI. 

 (ether[6:4] & 0xffffff00 == 0xaaaaaa00) or (ether[0:4] & 0xffffff00 == 0xaaaaaa00) 

The 1st part is for handling the MAC as a source and the 2nd as destination, if you skip any of the filter parts you'll get only the one direction of the traffic.