Sniffer Adaptive Application Analyzer: Adaptive Mode ... - NetScout
Sniffer Adaptive Application Analyzer: Adaptive Mode ... - NetScout Sniffer Adaptive Application Analyzer: Adaptive Mode ... - NetScout
EARLY FIELD TRIAL Chapter 8 Multiple Filter Mode and Exclude Filters 182 Sniffer Adaptive Application Analyzer When combining multiple filters in Multiple Filter Mode,Sniffer Adaptive Application Analyzer joins the filter with a logical OR rather than an AND. Because of this, joining multiple Exclude filters will always result in ALL packets passing the filter and being returned. Consider the following examples: Combing Include Filters in Multiple Filter Mode For example, suppose you set up the following filters: Filter 1 includes all packets of type A Filter 2 includes all packets of type B Combining these filters in Multiple Filter Mode and applying them to a trace file with packets of type A,B and C, will result in a filtered display with just packets of Type A and B. Combing Exclude Filters in Multiple Filter Mode Now, let’s apply the same logic to Exclude filters: Filter 1 excludes all packets of type A Filter 2 excludes all packets of type B Combining these filters in Multiple Filter Mode and applying them to a trace file with packets of type A,B and C, will result in a filtered display with packets of Type A, B, and C – all packets will pass the filter. This happens because the Exclude filters are joined with an OR condition between the filters. For a packet to be excluded from the filtered display, both the conditions must return FALSE. If even one condition returns TRUE, the packet gets included. The Boolean logic for this is: Not (Filter A or Filter B) = Not Filter A AND Not Filter B.
EARLY FIELD TRIAL Raw Capture Mode Postcapture Analysis Saving Sets of Filtered Frames / Creating New Windows You can save sets of filtered frames by selecting File > Save As with a filtered tab selected. A new window is created with the set of filtered frames in it, followed by the appearance of the Save As dialog box. When you use the Save As command on a set of filtered frames, the filtered frames in the new window are renumbered sequentially with new sequence numbers - the original sequence numbers are not preserved. You can also create new windows for filtered sets of frames by rightclicking a filtered tab and selecting the Create New Window command. A new postcapture window with just the filtered frames will appear. For a description of how to define a filter, see Using Manual Filters (Display > Define Filter) on page 183. Using Manual Filters (Display > Define Filter) This section describes how to use the Display Filter dialog box to create, manage, and apply manual display filters. Each time you create a new filter, you start by clicking the Profiles button in the Define Filter dialog box (Display > Define Filter). Then, click the New button to open a dialog that lets you assign the filter a profile name. Once you have successfully created a filter profile, it will appear in the Settings For panel so you can fine tune and apply the filter whenever you like. To create a filter profile: 1 Go to Display > Define Filter and the Define Filter dialog box appears. or Click the Define Filter icon 2 Click the Profiles button. The Capture Profiles dialog box appears, listing the filter profiles previously defined. User’s Guide 183
- Page 131 and 132: EARLY FIELD TRIAL Using Pattern Mat
- Page 133 and 134: EARLY FIELD TRIAL Applying Mining F
- Page 135 and 136: EARLY FIELD TRIAL Using Filters in
- Page 137 and 138: EARLY FIELD TRIAL Adaptive Display
- Page 139 and 140: EARLY FIELD TRIAL SECTION 3 Analyzi
- Page 141 and 142: EARLY FIELD TRIAL Adaptive Session
- Page 143 and 144: EARLY FIELD TRIAL Adaptive Mode Pos
- Page 145 and 146: EARLY FIELD TRIAL Adaptive Session
- Page 147 and 148: EARLY FIELD TRIAL Adaptive Session
- Page 149 and 150: EARLY FIELD TRIAL Session Overview
- Page 151 and 152: EARLY FIELD TRIAL Drilling Down to
- Page 153 and 154: EARLY FIELD TRIAL Adaptive Decode V
- Page 155 and 156: EARLY FIELD TRIAL Opening ASP Files
- Page 157 and 158: EARLY FIELD TRIAL Figure 7-9. Openi
- Page 159 and 160: EARLY FIELD TRIAL Using Filters wit
- Page 161 and 162: EARLY FIELD TRIAL Raw Capture Mode
- Page 163 and 164: EARLY FIELD TRIAL Table 8-1. Postca
- Page 165 and 166: EARLY FIELD TRIAL Introducing the P
- Page 167 and 168: EARLY FIELD TRIAL Granularity in De
- Page 169 and 170: EARLY FIELD TRIAL Packet Status Fla
- Page 171 and 172: EARLY FIELD TRIAL Table 8-5. Decode
- Page 173 and 174: EARLY FIELD TRIAL Types of Display
- Page 175 and 176: EARLY FIELD TRIAL Raw Capture Mode
- Page 177 and 178: EARLY FIELD TRIAL a The “Apply on
- Page 179 and 180: EARLY FIELD TRIAL Raw Capture Mode
- Page 181: EARLY FIELD TRIAL Raw Capture Mode
- Page 185 and 186: EARLY FIELD TRIAL Using the Manual
- Page 187 and 188: EARLY FIELD TRIAL 5 Click OK. Figur
- Page 189 and 190: EARLY FIELD TRIAL Raw Capture Mode
- Page 191 and 192: EARLY FIELD TRIAL Setting Display S
- Page 193 and 194: EARLY FIELD TRIAL Raw Capture Mode
- Page 195 and 196: EARLY FIELD TRIAL Table 8-9. Summar
- Page 197 and 198: EARLY FIELD TRIAL Raw Capture Mode
- Page 199 and 200: EARLY FIELD TRIAL Searching for Fra
- Page 201 and 202: EARLY FIELD TRIAL Raw Capture Mode
- Page 203 and 204: EARLY FIELD TRIAL Raw Capture Mode
- Page 205 and 206: EARLY FIELD TRIAL Raw Capture Mode
- Page 207 and 208: EARLY FIELD TRIAL Printing Decoded
- Page 209 and 210: EARLY FIELD TRIAL Using the Matrix
- Page 211 and 212: EARLY FIELD TRIAL Raw Capture Mode
- Page 213 and 214: EARLY FIELD TRIAL Using the Host Ta
- Page 215 and 216: EARLY FIELD TRIAL Using the Protoco
- Page 217 and 218: EARLY FIELD TRIAL Enabling VLAN Dat
- Page 219 and 220: EARLY FIELD TRIAL Expert Analysis O
- Page 221 and 222: EARLY FIELD TRIAL Expert Tool Bar T
- Page 223 and 224: EARLY FIELD TRIAL Expert Analysis
- Page 225 and 226: EARLY FIELD TRIAL Setting Expert Op
- Page 227 and 228: EARLY FIELD TRIAL Analyze Expert An
- Page 229 and 230: EARLY FIELD TRIAL Alarms Expert Ana
- Page 231 and 232: EARLY FIELD TRIAL Protocols To conf
EARLY FIELD TRIAL Chapter 8<br />
Multiple Filter <strong>Mode</strong> and Exclude Filters<br />
182 <strong>Sniffer</strong> <strong>Adaptive</strong> <strong>Application</strong> <strong>Analyzer</strong><br />
When combining multiple filters in Multiple Filter <strong>Mode</strong>,<strong>Sniffer</strong> <strong>Adaptive</strong><br />
<strong>Application</strong> <strong>Analyzer</strong> joins the filter with a logical OR rather than an AND.<br />
Because of this, joining multiple Exclude filters will always result in ALL<br />
packets passing the filter and being returned. Consider the following<br />
examples:<br />
Combing Include Filters in Multiple Filter <strong>Mode</strong><br />
For example, suppose you set up the following filters:<br />
Filter 1 includes all packets of type A<br />
Filter 2 includes all packets of type B<br />
Combining these filters in Multiple Filter <strong>Mode</strong> and applying them to a<br />
trace file with packets of type A,B and C, will result in a filtered display<br />
with just packets of Type A and B.<br />
Combing Exclude Filters in Multiple Filter <strong>Mode</strong><br />
Now, let’s apply the same logic to Exclude filters:<br />
Filter 1 excludes all packets of type A<br />
Filter 2 excludes all packets of type B<br />
Combining these filters in Multiple Filter <strong>Mode</strong> and applying them to a<br />
trace file with packets of type A,B and C, will result in a filtered display<br />
with packets of Type A, B, and C – all packets will pass the filter.<br />
This happens because the Exclude filters are joined with an OR condition<br />
between the filters. For a packet to be excluded from the filtered display,<br />
both the conditions must return FALSE. If even one condition returns<br />
TRUE, the packet gets included.<br />
The Boolean logic for this is:<br />
Not (Filter A or Filter B) = Not Filter A AND Not Filter B.
Change language