Sniffer Adaptive Application Analyzer: Adaptive Mode ... - NetScout

EARLY FIELD TRIAL
Types of Display Filters
Raw Capture Mode Postcapture Analysis
Sniffer Adaptive Application Analyzer provides several types of display
filters:
NOTE: Display filters are separate from Quick Select window filters.
Refer to Using Filters in the Quick Select Window on page 119 for
information on how to create Quick Select window filters and apply
them as source, mining, and statistics filters.
Table 8-6. Sniffer Adaptive Application Analyzer Display Filters
Filter Type Description
Automatic Display Filters
Using Automatic Display
Filters on page 174
Quick Display Filters
Using Quick Filters on page
178
Manual Display Filters
(Display > Define Filter)
Using Manual Filters (Display
> Define Filter) on page 183
Expert Display Filters
Setting Automatic Expert
Display Filters on page 222
You can automatically populate the Define Filter - Display dialog
box’s tabs with filter settings based on selected portions of the
currently selected packet in the Decode tab. You do this by using
the dropdown at the top of the Decode tab to specify which portion
of the selected packet you want to use as a filter (for example, just
the source IP address) and clicking the Define Display Filter
button.
Quick Display Filters are similar to automatic display filters – they
filter the active Decode tab based on selected portions of the
currently selected packet in the Decode tab. The main difference is
that they take effect immediately without displaying the Define
Filter dialog box first.
You set Quick Filters by using the dropdown at the top of the
Decode tab to specify which portion of the selected packet you
want to use as a filter (for example, just the source port) and
clicking the Quick Filter button.
Note: You set global options for how Quick Filters are applied in the
Display > Display Setup > Packet Selection tab. These options
specify to which packets Quick Filters should be applied (all or
selected) and how results should be returned (by selecting/clearing
packets in the active tab or by showing a new filtered tab at the
base of the postcapture display window).
You can set Display filters manually in the Define Filter - Display
dialog box. This dialog box is available by using the Display >
Define Filter command. Then, you have full access to the
standard Define Filter tabs described in Using Manual Filters
(Display > Define Filter) on page 183.
You can also set automatic Expert filters that only display data
associated with a particular network object, symptom, or diagnosis.
You do this by displaying the Expert tab, selecting an object,
symptom, or diagnosis and clicking the Display Filter button.
User’s Guide 173