Sniffer® Portable Professional User's Guide - NetScout

Chapter 8
176 Sniffer Portable Professional
Single filter mode functions as a regular, single filter. With
the Single Filter Mode option, you are limited to only one
filter selection in the Select Filter dialog box. Selecting one
filter automatically deselects the previously selected filter.
Selecting a “parent” filter is not a valid filter. You must
specify a single filter within the parent grouping.
3 Use the Select matching, Clear selected, and Apply on
selected set options to specify how the display filter will be applied
and its results returned. See Filtered Tabs or Marked Frames? on
page 171 and The “Apply on Selected Set” Option on page 171 for
more information.
4 Click OK to apply the selected filter(s) on the active Decode tab.
Multiple Filter Mode and Exclude Filters
When combining multiple filters in Multiple Filter Mode, Sniffer Portable
Professional joins the filter with a logical OR rather than an AND.
Because of this, joining multiple Exclude filters will always result in ALL
packets passing the filter and being returned. Consider the following
examples:
Combing Include Filters in Multiple Filter Mode
For example, suppose you set up the following filters:
Filter 1 includes all packets of type A
Filter 2 includes all packets of type B
Combining these filters in Multiple Filter Mode and applying them to a
trace file with packets of type A,B and C, will result in a filtered display
with just packets of Type A and B.
Combing Exclude Filters in Multiple Filter Mode
Now, let’s apply the same logic to Exclude filters:
Filter 1 excludes all packets of type A
Filter 2 excludes all packets of type B
Combining these filters in Multiple Filter Mode and applying them to a
trace file with packets of type A,B and C, will result in a filtered display
with packets of Type A, B, and C – all packets will pass the filter.
This happens because the Exclude filters are joined with an OR condition
between the filters. For a packet to be excluded from the filtered display,
both the conditions must return FALSE. If even one condition returns
TRUE, the packet gets included.