Chapter 1 What’s New for FortiOS 5.0 : Other new features : Sniffer modes: one-armed and normal : Configuring an interface to operate as a one-arm sniffer
  
Configuring an interface to operate as a one-arm sniffer
Connect the interface to the network to be analyzed. Go to System > Network > Interfaces and edit the interface and select One-Arm Sniffer and select Apply.
Configure the sniffer by selecting Enable Filters to filter traffic by IP address (host), address range, port number, VLANs and protocols. You can also configure the sniffer to Include IPv6 Packets and to Include Non-IP Packets.
Finally, under Security Profiles you can select Security profiles to apply to the sniffer.
Select Apply to save your changes.
Figure 97: Example one-arm sniffer configuration