Sniffer Adaptive Application Analyzer: Adaptive Mode ... - NetScout
Sniffer Adaptive Application Analyzer: Adaptive Mode ... - NetScout Sniffer Adaptive Application Analyzer: Adaptive Mode ... - NetScout
About Quick Select Filters EARLY FIELD TRIAL Chapter 6 120 Sniffer Adaptive Application Analyzer Sniffer Adaptive Application Analyzer provides centralized filter creation and management using the Mining Filtering controls at the base of the Quick Select window (Figure 6-1). Figure 6-1. Centralized Filter Creation in Sniffer Adaptive Application Analyzer Quick Select filters let you include/exclude packets matching precise combinations of network criteria, including MAC addresses, IP addresses, ports, IP protocols, pattern matches, and so on. Quick Select filters can be very simple, consisting of a single term, or very sophisticated, involving multiple terms connected by Boolean AND/ OR/NOT operators. You can also specify that specific terms be included or excluded.
EARLY FIELD TRIAL Reusable Filters with Multiple Filter Points Using Filters in the Quick Select Window Once you have created a filter from the Quick Select window, you can use (and reuse) it as a Mining filter, Source filter, Display filter, or Statistics filter. Table 6-1 summarizes the differences between each of these filter points. Figure 6-2 illustrates the Source, Mining, and Statistics filter points; refer to Applying Adaptive Display Filters on page 136 for information on using Quick Select filters as Display filters with Adaptive Session/Packet data. Table 6-1. Quick Select Window Filters Filter Type & Description How Applied? Mode? Source Filters Source Filters are applied at the network interface. They exclude packets matching specified criteria from monitoring or capture: • Monitor statistics in the Quick Select window will not include packets excluded by a source filter. This includes both the Graph panel and all Statistics panel tabs. • Postcapture analysis will not include packets excluded by a source filter. This includes both Adaptive and raw packet postcapture views. Note: Because source filters prevent matching packets from ever being seen by Sniffer Adaptive Application Analyzer, you should apply them carefully. Mining Filters Mining filters are applied when you click the Mine button to retrieve stored packet data (ASPs or raw packets) from the capture buffer. They are used to focus postcapture analysis on packet data matching specified criteria. Right-click a stream in the Navigation panel, choose Apply Source Filter, and select the filter to use as a source filter. Once you’ve applied a source filter to a stream, its entry in the Navigation panel appears with a distinctive icon when selected. Select a filter from the Mining Filtering dropdown at the base of the Quick Select window before clicking the Mine button. Alternatively, you can use the Edit Filter button in the Summary dialog box that appears after clicking Mine. Adaptive and Raw Adaptive and Raw User’s Guide 121
- Page 69 and 70: EARLY FIELD TRIAL Working with the
- Page 71 and 72: EARLY FIELD TRIAL Using the Statist
- Page 73 and 74: EARLY FIELD TRIAL Summary Tab a Usi
- Page 75 and 76: EARLY FIELD TRIAL Using the Statist
- Page 77 and 78: EARLY FIELD TRIAL Port Tab Using th
- Page 79 and 80: EARLY FIELD TRIAL Network Tab Using
- Page 81 and 82: EARLY FIELD TRIAL Destination Tab U
- Page 83 and 84: EARLY FIELD TRIAL Using the Statist
- Page 85 and 86: EARLY FIELD TRIAL VLAN ID Tab Using
- Page 87 and 88: EARLY FIELD TRIAL Reports Tabs Usi
- Page 89 and 90: EARLY FIELD TRIAL Top Conversations
- Page 91 and 92: EARLY FIELD TRIAL Multicast Protoco
- Page 93 and 94: EARLY FIELD TRIAL Working with the
- Page 95 and 96: EARLY FIELD TRIAL Using the Statist
- Page 97 and 98: EARLY FIELD TRIAL Refreshing Statis
- Page 99 and 100: EARLY FIELD TRIAL Using the Statist
- Page 101 and 102: EARLY FIELD TRIAL Showing and Hidin
- Page 103 and 104: EARLY FIELD TRIAL Resolving DNS Nam
- Page 105 and 106: EARLY FIELD TRIAL Table 4-1. New Co
- Page 107 and 108: EARLY FIELD TRIAL SECTION 2 Capturi
- Page 109 and 110: EARLY FIELD TRIAL Capturing and Min
- Page 111 and 112: EARLY FIELD TRIAL Configuring and S
- Page 113 and 114: EARLY FIELD TRIAL Capture Mode Adap
- Page 115 and 116: EARLY FIELD TRIAL Mining Packet Dat
- Page 117 and 118: EARLY FIELD TRIAL Capturing and Min
- Page 119: EARLY FIELD TRIAL Using Filters in
- Page 123 and 124: EARLY FIELD TRIAL Figure 6-2. Apply
- Page 125 and 126: EARLY FIELD TRIAL Working with Auto
- Page 127 and 128: EARLY FIELD TRIAL Table 6-3. Filter
- Page 129 and 130: EARLY FIELD TRIAL Using Filters in
- Page 131 and 132: EARLY FIELD TRIAL Using Pattern Mat
- Page 133 and 134: EARLY FIELD TRIAL Applying Mining F
- Page 135 and 136: EARLY FIELD TRIAL Using Filters in
- Page 137 and 138: EARLY FIELD TRIAL Adaptive Display
- Page 139 and 140: EARLY FIELD TRIAL SECTION 3 Analyzi
- Page 141 and 142: EARLY FIELD TRIAL Adaptive Session
- Page 143 and 144: EARLY FIELD TRIAL Adaptive Mode Pos
- Page 145 and 146: EARLY FIELD TRIAL Adaptive Session
- Page 147 and 148: EARLY FIELD TRIAL Adaptive Session
- Page 149 and 150: EARLY FIELD TRIAL Session Overview
- Page 151 and 152: EARLY FIELD TRIAL Drilling Down to
- Page 153 and 154: EARLY FIELD TRIAL Adaptive Decode V
- Page 155 and 156: EARLY FIELD TRIAL Opening ASP Files
- Page 157 and 158: EARLY FIELD TRIAL Figure 7-9. Openi
- Page 159 and 160: EARLY FIELD TRIAL Using Filters wit
- Page 161 and 162: EARLY FIELD TRIAL Raw Capture Mode
- Page 163 and 164: EARLY FIELD TRIAL Table 8-1. Postca
- Page 165 and 166: EARLY FIELD TRIAL Introducing the P
- Page 167 and 168: EARLY FIELD TRIAL Granularity in De
- Page 169 and 170: EARLY FIELD TRIAL Packet Status Fla
About Quick Select Filters<br />
EARLY FIELD TRIAL Chapter 6<br />
120 <strong>Sniffer</strong> <strong>Adaptive</strong> <strong>Application</strong> <strong>Analyzer</strong><br />
<strong>Sniffer</strong> <strong>Adaptive</strong> <strong>Application</strong> <strong>Analyzer</strong> provides centralized filter creation<br />
and management using the Mining Filtering controls at the base of the<br />
Quick Select window (Figure 6-1).<br />
Figure 6-1. Centralized Filter Creation in <strong>Sniffer</strong> <strong>Adaptive</strong> <strong>Application</strong><br />
<strong>Analyzer</strong><br />
Quick Select filters let you include/exclude packets matching precise<br />
combinations of network criteria, including MAC addresses, IP<br />
addresses, ports, IP protocols, pattern matches, and so on.<br />
Quick Select filters can be very simple, consisting of a single term, or<br />
very sophisticated, involving multiple terms connected by Boolean AND/<br />
OR/NOT operators. You can also specify that specific terms be included<br />
or excluded.
Change language