Sniffer Adaptive Application Analyzer: Adaptive Mode ... - NetScout

Sniffer Adaptive Application Analyzer: Adaptive Mode ... - NetScout Sniffer Adaptive Application Analyzer: Adaptive Mode ... - NetScout

10.03.2013 Views

EARLY FIELD TRIAL Chapter 6 128 Sniffer Adaptive Application Analyzer IMPORTANT: Clicking OK only saves changes to an Auto Filter or Temporary filter if it is selected. If it is not selected, changes made to an Auto Filter or Temporary filter will not be saved when you click OK. IMPORTANT: The Auto Filter and Temporary filters are special, reserved filters used by the system. These filter types provide you with the ability to set up filters quickly without worrying about saving them right away. The Auto Filter and Temporary filter settings stay preserved in memory until a new temporary filter is created. NOTE: If you click OK after editing an Auto Filter, the Auto Filter will be saved as a Temporary filter. You can still return to the Create/Edit Filters dialog box and save it with a permanent name, but you must do so before creating a new Temporary filter. Creating a new Temporary filter remove’s the previous Temporary filter’s settings from memory. Cancel cancels all actions and returns you to the Quick Select window. Help displays context-sensitive help for the Create/Edit Filters dialog box. Using the Filter Editor Context Menu You can right-click in the Filter Editor workspace to access the context menu (Figure 6-4). The context menu gives you easy access to most of the same functionality as the buttons described in Table 6-3 on page 127 and also adds Copy, Cut, and Paste functionality. You can insert and delete terms and operators, rename terms, toggle operators and terms, and change directions, just as you would with the buttons at the base of the Filter Editor workspace. Figure 6-4. Filter Editor Context Menu

EARLY FIELD TRIAL Using Filters in the Quick Select Window Adding Terms to the Create/Edit Filters Dialog Box When adding terms to a filter, different options appear depending on the type of term you are adding, as described in the table below. For all terms, you can either Exclude the term by checking the Exclude box in the dialog box that appears when you click Add, or Include the term by leaving the box blank. You can toggle this selection later using the Toggle NOT button. Maximum Number of Filter Terms The maximum number of filter terms supported for a single filter is 140. Filter Validation Table 6-4. Adding Terms to a Filter Term Options MAC Address (VLAN/MPLS) When you click the Mine button at the base of the Quick Select window, the Sniffer Adaptive Application Analyzer will evaluate the selected filter to see if it contains any terms that do not apply to the selected stream or trace file. If the selected filter is incompatible with the selected stream or trace file, you will be prompted to select a new filter or modify the current filter. Filter Criteria for Adaptive Workflows When creating filters from the Adaptive Session or Decode views, only IP Address and Port criteria are available for use. Filters created from the Quick Select window that include criteria other than IP addresses and ports (for example, a MAC address) will not return any matching data when used against the Adaptive views. Supply in hexadecimal format. IP Address Supply in familiar dotted-quad notation with the appropriate number of subnet mask bits in the Mask field. Port Supply either a single port number, or click the Port Range button to add a range of ports. VLAN (VLAN) Supply a VLAN ID. IP Protocol Supply the IP protocol number. NOTE: For a list of mappings between the decimal notation for IP Protocol numbers and the common names, see http://www.iana.org/assignments/ protocol-numbers. User’s Guide 129

EARLY FIELD TRIAL<br />

Using Filters in the Quick Select Window<br />

Adding Terms to the Create/Edit Filters Dialog Box<br />

When adding terms to a filter, different options appear depending on the<br />

type of term you are adding, as described in the table below.<br />

For all terms, you can either Exclude the term by checking the Exclude<br />

box in the dialog box that appears when you click Add, or Include the<br />

term by leaving the box blank. You can toggle this selection later using<br />

the Toggle NOT button.<br />

Maximum Number of Filter Terms<br />

The maximum number of filter terms supported for a single filter is 140.<br />

Filter Validation<br />

Table 6-4. Adding Terms to a Filter<br />

Term Options<br />

MAC Address<br />

(VLAN/MPLS)<br />

When you click the Mine button at the base of the Quick Select window,<br />

the <strong>Sniffer</strong> <strong>Adaptive</strong> <strong>Application</strong> <strong>Analyzer</strong> will evaluate the selected filter<br />

to see if it contains any terms that do not apply to the selected stream<br />

or trace file. If the selected filter is incompatible with the selected stream<br />

or trace file, you will be prompted to select a new filter or modify the<br />

current filter.<br />

Filter Criteria for <strong>Adaptive</strong> Workflows<br />

When creating filters from the <strong>Adaptive</strong> Session or Decode views, only<br />

IP Address and Port criteria are available for use.<br />

Filters created from the Quick Select window that include criteria other<br />

than IP addresses and ports (for example, a MAC address) will not return<br />

any matching data when used against the <strong>Adaptive</strong> views.<br />

Supply in hexadecimal format.<br />

IP Address Supply in familiar dotted-quad notation with the appropriate number of<br />

subnet mask bits in the Mask field.<br />

Port Supply either a single port number, or click the Port Range button to add a<br />

range of ports.<br />

VLAN (VLAN) Supply a VLAN ID.<br />

IP Protocol Supply the IP protocol number.<br />

NOTE: For a list of mappings between the decimal notation for IP Protocol<br />

numbers and the common names, see http://www.iana.org/assignments/<br />

protocol-numbers.<br />

User’s Guide 129

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!