Sniffer Adaptive Application Analyzer: Adaptive Mode ... - NetScout
Sniffer Adaptive Application Analyzer: Adaptive Mode ... - NetScout Sniffer Adaptive Application Analyzer: Adaptive Mode ... - NetScout
EARLY FIELD TRIAL Chapter 6 128 Sniffer Adaptive Application Analyzer IMPORTANT: Clicking OK only saves changes to an Auto Filter or Temporary filter if it is selected. If it is not selected, changes made to an Auto Filter or Temporary filter will not be saved when you click OK. IMPORTANT: The Auto Filter and Temporary filters are special, reserved filters used by the system. These filter types provide you with the ability to set up filters quickly without worrying about saving them right away. The Auto Filter and Temporary filter settings stay preserved in memory until a new temporary filter is created. NOTE: If you click OK after editing an Auto Filter, the Auto Filter will be saved as a Temporary filter. You can still return to the Create/Edit Filters dialog box and save it with a permanent name, but you must do so before creating a new Temporary filter. Creating a new Temporary filter remove’s the previous Temporary filter’s settings from memory. Cancel cancels all actions and returns you to the Quick Select window. Help displays context-sensitive help for the Create/Edit Filters dialog box. Using the Filter Editor Context Menu You can right-click in the Filter Editor workspace to access the context menu (Figure 6-4). The context menu gives you easy access to most of the same functionality as the buttons described in Table 6-3 on page 127 and also adds Copy, Cut, and Paste functionality. You can insert and delete terms and operators, rename terms, toggle operators and terms, and change directions, just as you would with the buttons at the base of the Filter Editor workspace. Figure 6-4. Filter Editor Context Menu
EARLY FIELD TRIAL Using Filters in the Quick Select Window Adding Terms to the Create/Edit Filters Dialog Box When adding terms to a filter, different options appear depending on the type of term you are adding, as described in the table below. For all terms, you can either Exclude the term by checking the Exclude box in the dialog box that appears when you click Add, or Include the term by leaving the box blank. You can toggle this selection later using the Toggle NOT button. Maximum Number of Filter Terms The maximum number of filter terms supported for a single filter is 140. Filter Validation Table 6-4. Adding Terms to a Filter Term Options MAC Address (VLAN/MPLS) When you click the Mine button at the base of the Quick Select window, the Sniffer Adaptive Application Analyzer will evaluate the selected filter to see if it contains any terms that do not apply to the selected stream or trace file. If the selected filter is incompatible with the selected stream or trace file, you will be prompted to select a new filter or modify the current filter. Filter Criteria for Adaptive Workflows When creating filters from the Adaptive Session or Decode views, only IP Address and Port criteria are available for use. Filters created from the Quick Select window that include criteria other than IP addresses and ports (for example, a MAC address) will not return any matching data when used against the Adaptive views. Supply in hexadecimal format. IP Address Supply in familiar dotted-quad notation with the appropriate number of subnet mask bits in the Mask field. Port Supply either a single port number, or click the Port Range button to add a range of ports. VLAN (VLAN) Supply a VLAN ID. IP Protocol Supply the IP protocol number. NOTE: For a list of mappings between the decimal notation for IP Protocol numbers and the common names, see http://www.iana.org/assignments/ protocol-numbers. User’s Guide 129
- Page 77 and 78: EARLY FIELD TRIAL Port Tab Using th
- Page 79 and 80: EARLY FIELD TRIAL Network Tab Using
- Page 81 and 82: EARLY FIELD TRIAL Destination Tab U
- Page 83 and 84: EARLY FIELD TRIAL Using the Statist
- Page 85 and 86: EARLY FIELD TRIAL VLAN ID Tab Using
- Page 87 and 88: EARLY FIELD TRIAL Reports Tabs Usi
- Page 89 and 90: EARLY FIELD TRIAL Top Conversations
- Page 91 and 92: EARLY FIELD TRIAL Multicast Protoco
- Page 93 and 94: EARLY FIELD TRIAL Working with the
- Page 95 and 96: EARLY FIELD TRIAL Using the Statist
- Page 97 and 98: EARLY FIELD TRIAL Refreshing Statis
- Page 99 and 100: EARLY FIELD TRIAL Using the Statist
- Page 101 and 102: EARLY FIELD TRIAL Showing and Hidin
- Page 103 and 104: EARLY FIELD TRIAL Resolving DNS Nam
- Page 105 and 106: EARLY FIELD TRIAL Table 4-1. New Co
- Page 107 and 108: EARLY FIELD TRIAL SECTION 2 Capturi
- Page 109 and 110: EARLY FIELD TRIAL Capturing and Min
- Page 111 and 112: EARLY FIELD TRIAL Configuring and S
- Page 113 and 114: EARLY FIELD TRIAL Capture Mode Adap
- Page 115 and 116: EARLY FIELD TRIAL Mining Packet Dat
- Page 117 and 118: EARLY FIELD TRIAL Capturing and Min
- Page 119 and 120: EARLY FIELD TRIAL Using Filters in
- Page 121 and 122: EARLY FIELD TRIAL Reusable Filters
- Page 123 and 124: EARLY FIELD TRIAL Figure 6-2. Apply
- Page 125 and 126: EARLY FIELD TRIAL Working with Auto
- Page 127: EARLY FIELD TRIAL Table 6-3. Filter
- Page 131 and 132: EARLY FIELD TRIAL Using Pattern Mat
- Page 133 and 134: EARLY FIELD TRIAL Applying Mining F
- Page 135 and 136: EARLY FIELD TRIAL Using Filters in
- Page 137 and 138: EARLY FIELD TRIAL Adaptive Display
- Page 139 and 140: EARLY FIELD TRIAL SECTION 3 Analyzi
- Page 141 and 142: EARLY FIELD TRIAL Adaptive Session
- Page 143 and 144: EARLY FIELD TRIAL Adaptive Mode Pos
- Page 145 and 146: EARLY FIELD TRIAL Adaptive Session
- Page 147 and 148: EARLY FIELD TRIAL Adaptive Session
- Page 149 and 150: EARLY FIELD TRIAL Session Overview
- Page 151 and 152: EARLY FIELD TRIAL Drilling Down to
- Page 153 and 154: EARLY FIELD TRIAL Adaptive Decode V
- Page 155 and 156: EARLY FIELD TRIAL Opening ASP Files
- Page 157 and 158: EARLY FIELD TRIAL Figure 7-9. Openi
- Page 159 and 160: EARLY FIELD TRIAL Using Filters wit
- Page 161 and 162: EARLY FIELD TRIAL Raw Capture Mode
- Page 163 and 164: EARLY FIELD TRIAL Table 8-1. Postca
- Page 165 and 166: EARLY FIELD TRIAL Introducing the P
- Page 167 and 168: EARLY FIELD TRIAL Granularity in De
- Page 169 and 170: EARLY FIELD TRIAL Packet Status Fla
- Page 171 and 172: EARLY FIELD TRIAL Table 8-5. Decode
- Page 173 and 174: EARLY FIELD TRIAL Types of Display
- Page 175 and 176: EARLY FIELD TRIAL Raw Capture Mode
- Page 177 and 178: EARLY FIELD TRIAL a The “Apply on
EARLY FIELD TRIAL<br />
Using Filters in the Quick Select Window<br />
Adding Terms to the Create/Edit Filters Dialog Box<br />
When adding terms to a filter, different options appear depending on the<br />
type of term you are adding, as described in the table below.<br />
For all terms, you can either Exclude the term by checking the Exclude<br />
box in the dialog box that appears when you click Add, or Include the<br />
term by leaving the box blank. You can toggle this selection later using<br />
the Toggle NOT button.<br />
Maximum Number of Filter Terms<br />
The maximum number of filter terms supported for a single filter is 140.<br />
Filter Validation<br />
Table 6-4. Adding Terms to a Filter<br />
Term Options<br />
MAC Address<br />
(VLAN/MPLS)<br />
When you click the Mine button at the base of the Quick Select window,<br />
the <strong>Sniffer</strong> <strong>Adaptive</strong> <strong>Application</strong> <strong>Analyzer</strong> will evaluate the selected filter<br />
to see if it contains any terms that do not apply to the selected stream<br />
or trace file. If the selected filter is incompatible with the selected stream<br />
or trace file, you will be prompted to select a new filter or modify the<br />
current filter.<br />
Filter Criteria for <strong>Adaptive</strong> Workflows<br />
When creating filters from the <strong>Adaptive</strong> Session or Decode views, only<br />
IP Address and Port criteria are available for use.<br />
Filters created from the Quick Select window that include criteria other<br />
than IP addresses and ports (for example, a MAC address) will not return<br />
any matching data when used against the <strong>Adaptive</strong> views.<br />
Supply in hexadecimal format.<br />
IP Address Supply in familiar dotted-quad notation with the appropriate number of<br />
subnet mask bits in the Mask field.<br />
Port Supply either a single port number, or click the Port Range button to add a<br />
range of ports.<br />
VLAN (VLAN) Supply a VLAN ID.<br />
IP Protocol Supply the IP protocol number.<br />
NOTE: For a list of mappings between the decimal notation for IP Protocol<br />
numbers and the common names, see http://www.iana.org/assignments/<br />
protocol-numbers.<br />
User’s Guide 129