Sniffer Adaptive Application Analyzer: Adaptive Mode ... - NetScout

EARLY FIELD TRIAL
Using Pattern Matches with Mining Filters
Using Filters in the Quick Select Window
Sniffer Adaptive Application Analyzer includes a Pattern Matching
feature that lets you search for any data pattern at a fixed offset within
your captured packet data. This is extremely useful when you're
searching for packets containing addresses in encapsulated frames or a
custom application value that occurs at a predetermined offset in the
packet. Pattern Matching optimizes your mining performance by
returning only those packets that match your pattern-specific search
parameters.
NOTE: For ASCII Pattern Match filtering to be successful, you must
supply the exact offset at which the specified ASCII string will be
found. ASCII data must be within the valid range of printing ASCII
characters (33-126 decimal; 0x21 - 0x7F hexadecimal).
To add a Pattern Match filter term:
1 Open the Mining Filters window by clicking either the Create or
Edit button in the Mining Filtering controls at the base of the Quick
Select window.
2 Add a Pattern Match term by clicking the dropdown listing available
filter terms, selecting Pattern Match, and clicking Add.
3 The Edit Pattern dialog box appears. Use this dialog to configure
your new filter term.
Figure 6-5. Edit Pattern Dialog Box
Pattern Match terms can include up to 32 bytes of Hex or ASCII pattern,
along with a fixed offset into the packet. Optional masking allows you to
turn specific pattern bits on or off for more complex patterns.
User’s Guide 131