Sniffer® Portable Professional User's Guide - NetScout

Setting Display Filters
Displaying Captured Data
A filter applied to the display of captured data is called a display filter.
Display filters let you select the packets you want to display in a Decode
tab. Display filters do not affect the contents of the capture buffer. They
just prevent some of the data from being displayed.
You can use display filters to view only:
Packets transmitted between network nodes (or address pairs)
Packets that belong to one or more protocol groups
Packets that match predefined data patterns
Error packets
Packets that belong to a certain size range
Packets that match various combinations of the above
specifications
IMPORTANT: Defining Filters and Triggers on page 219 provides the
details on working with Sniffer filters in general – monitor, capture, and
display. This section adds to that information with some additional topics
specifically for display filters.
Types of Display Filters
The Sniffer provides several types of display filters:
Manual Display Filters
You can set Display filters manually in the Define Filter - Display dialog
box. This dialog box is available by using the Display > Define Filter
command. Then, you have full access to the standard Define Filter tabs
described in Defining Filters and Triggers on page 219.
Automatic Display Filters
You can automatically populate the Define Filter - Display dialog box’s
tabs with filter settings based on selected portions of the currently
selected packet in the Decode tab. You do this by using the dropdown at
the top of the Decode tab to specify which portion of the selected packet
you want to use as a filter (for example, just the source IP address) and
clicking the Define Display Filter button.
See Using Automatic Display Filters on page 168.
User’s Guide 167