Best way to capture PPPoE control packets

[motific]

Under some very specific circumstances, something somewhere drops the PPP session. When I look in the logs I see...

Jan 11 10:15:16	ppp	24596	[wan_link0] LCP: rec'd Terminate Request #3 (Opened)

and this looks like the ISP end closing the connection to me, not pfSense but I need the evidence before bending some lowly support tech's ear.

The vdsl bridge is reporting a lot of errors which persist under a range of conditions, but only these specific conditions cause the ppp session to be reset. I need to be able to understand what is the nature of this specific traffic that is leading to an unexpected excrement / fan interface and who is actually dropping the connection.

To do that I want to packet capture on the interface that the pppoe connection sits on (re0 - yes, I know... realtek) to pull out data and control messaging - but it's not listed in packet capture on the interface.

Is there a 'best' way to do it, or should I SSH in and do it from there?

[stephenw10]

If you use tcpdump from the command line you can just use re0 directly.

But you can also assign and enable re0 in the webgui, but leave the IP type as none, and it will be available in the pcap menu.

Steve