Sniffer® Portable Professional User's Guide - NetScout
Sniffer® Portable Professional User's Guide - NetScout Sniffer® Portable Professional User's Guide - NetScout
Chapter 8 176 Sniffer Portable Professional Single filter mode functions as a regular, single filter. With the Single Filter Mode option, you are limited to only one filter selection in the Select Filter dialog box. Selecting one filter automatically deselects the previously selected filter. Selecting a “parent” filter is not a valid filter. You must specify a single filter within the parent grouping. 3 Use the Select matching, Clear selected, and Apply on selected set options to specify how the display filter will be applied and its results returned. See Filtered Tabs or Marked Frames? on page 171 and The “Apply on Selected Set” Option on page 171 for more information. 4 Click OK to apply the selected filter(s) on the active Decode tab. Multiple Filter Mode and Exclude Filters When combining multiple filters in Multiple Filter Mode, Sniffer Portable Professional joins the filter with a logical OR rather than an AND. Because of this, joining multiple Exclude filters will always result in ALL packets passing the filter and being returned. Consider the following examples: Combing Include Filters in Multiple Filter Mode For example, suppose you set up the following filters: Filter 1 includes all packets of type A Filter 2 includes all packets of type B Combining these filters in Multiple Filter Mode and applying them to a trace file with packets of type A,B and C, will result in a filtered display with just packets of Type A and B. Combing Exclude Filters in Multiple Filter Mode Now, let’s apply the same logic to Exclude filters: Filter 1 excludes all packets of type A Filter 2 excludes all packets of type B Combining these filters in Multiple Filter Mode and applying them to a trace file with packets of type A,B and C, will result in a filtered display with packets of Type A, B, and C – all packets will pass the filter. This happens because the Exclude filters are joined with an OR condition between the filters. For a packet to be excluded from the filtered display, both the conditions must return FALSE. If even one condition returns TRUE, the packet gets included.
The Boolean logic for this is: Not (Filter A or Filter B) = Not Filter A AND Not Filter B. Displaying Captured Data Saving Sets of Filtered Frames / Creating New Windows You can save sets of filtered frames by selecting File > Save As with a filtered tab selected. A new window is created with the set of filtered frames in it, followed by the appearance of the Save As dialog box. When you use the Save As command on a set of filtered frames, the filtered frames in the new window are renumbered sequentially with new sequence numbers - the original sequence numbers are not preserved. You can also create new windows for filtered sets of frames by right-clicking a filtered tab and selecting the Create New Window command. A new postcapture window with just the filtered frames will appear. For a description of how to define a filter, see Defining Filters and Triggers on page 219. Setting Display Setup Options You can customize the way data is displayed in the decode display. You can: Exclude certain subprotocols from the summary pane (this is a more detailed control than a display filter). Set the summary address field format (network or hardware). Specify whether the two-station display format should be used. Select optional fields to be shown in the summary display. Color-code packets displayed in the summary pane based on their protocol. Select the font for the detail display. To set the display options: 1 Select Display Setup from the Display menu. The Display Setup dialog tabs are summarized in the following table. User’s Guide 177
- Page 126 and 127: Chapter 6 Tips: 126 Sniffer Portabl
- Page 128 and 129: Chapter 6 Capturing from Specific S
- Page 130 and 131: Chapter 6 130 Sniffer Portable Prof
- Page 132 and 133: Chapter 7 132 Sniffer Portable Prof
- Page 134 and 135: Chapter 7 Setting Expert Options 13
- Page 136 and 137: Chapter 7 136 Sniffer Portable Prof
- Page 138 and 139: Chapter 7 Expert Subnet Mask Settin
- Page 140 and 141: Chapter 7 140 Sniffer Portable Prof
- Page 142 and 143: Chapter 7 142 Sniffer Portable Prof
- Page 144 and 145: Chapter 7 Discovered access points
- Page 146 and 147: Chapter 7 146 Sniffer Portable Prof
- Page 148 and 149: Chapter 7 148 Sniffer Portable Prof
- Page 150 and 151: Chapter 7 Expert Oracle Options 150
- Page 152 and 153: Chapter 7 Limitations of the Expert
- Page 154 and 155: Chapter 7 Click to show the packet
- Page 156 and 157: Chapter 7 156 Sniffer Portable Prof
- Page 158 and 159: Chapter 8 Displaying Captured Packe
- Page 160 and 161: Chapter 8 Postcapture Views for Wir
- Page 162 and 163: Chapter 8 162 Sniffer Portable Prof
- Page 164 and 165: Chapter 8 164 Sniffer Portable Prof
- Page 166 and 167: Chapter 8 Table 8-3. Decode Tab Too
- Page 168 and 169: Chapter 8 168 Sniffer Portable Prof
- Page 170 and 171: Chapter 8 b 170 Sniffer Portable Pr
- Page 172 and 173: Chapter 8 a 172 Sniffer Portable Pr
- Page 174 and 175: Chapter 8 174 Sniffer Portable Prof
- Page 178 and 179: Chapter 8 178 Sniffer Portable Prof
- Page 180 and 181: Chapter 8 Display Setup > Summary D
- Page 182 and 183: Chapter 8 182 Sniffer Portable Prof
- Page 184 and 185: Chapter 8 184 Sniffer Portable Prof
- Page 186 and 187: Chapter 8 Searching for Frames in t
- Page 188 and 189: Chapter 8 Searching for Frames Matc
- Page 190 and 191: Chapter 8 Searching for Frames Matc
- Page 192 and 193: Chapter 8 Searching for Data Patter
- Page 194 and 195: Chapter 8 194 Sniffer Portable Prof
- Page 196 and 197: Chapter 8 Printing Decoded Packets
- Page 198 and 199: Chapter 8 Using Protocol Forcing Yo
- Page 200 and 201: Chapter 8 Sniffer Portable Professi
- Page 202 and 203: Chapter 8 Postcapture Matrix Tab 20
- Page 204 and 205: Chapter 8 More about the Matrix Tra
- Page 206 and 207: Chapter 8 Postcapture Host Table Ta
- Page 208 and 209: Chapter 8 Postcapture Protocol Dist
- Page 210 and 211: Chapter 8 Postcapture Statistics Ta
- Page 212 and 213: Chapter 8 212 Sniffer Portable Prof
- Page 214 and 215: Chapter 9 4 Click OK. 214 Sniffer P
- Page 216 and 217: Chapter 9 216 Sniffer Portable Prof
- Page 218 and 219: Chapter 9 218 Sniffer Portable Prof
- Page 220 and 221: Chapter 10 220 Sniffer Portable Pro
- Page 222 and 223: Chapter 10 Using a Defined Filter U
- Page 224 and 225: Chapter 10 224 Sniffer Portable Pro
The Boolean logic for this is:<br />
Not (Filter A or Filter B) = Not Filter A AND Not Filter B.<br />
Displaying Captured Data<br />
Saving Sets of Filtered Frames / Creating New Windows<br />
You can save sets of filtered frames by selecting File > Save As with a<br />
filtered tab selected. A new window is created with the set of filtered<br />
frames in it, followed by the appearance of the Save As dialog box.<br />
When you use the Save As command on a set of filtered frames, the<br />
filtered frames in the new window are renumbered sequentially with new<br />
sequence numbers - the original sequence numbers are not preserved.<br />
You can also create new windows for filtered sets of frames by<br />
right-clicking a filtered tab and selecting the Create New Window<br />
command. A new postcapture window with just the filtered frames will<br />
appear.<br />
For a description of how to define a filter, see Defining Filters and<br />
Triggers on page 219.<br />
Setting Display Setup Options<br />
You can customize the way data is displayed in the decode display. You<br />
can:<br />
Exclude certain subprotocols from the summary pane (this is a<br />
more detailed control than a display filter).<br />
Set the summary address field format (network or hardware).<br />
Specify whether the two-station display format should be used.<br />
Select optional fields to be shown in the summary display.<br />
Color-code packets displayed in the summary pane based on their<br />
protocol.<br />
Select the font for the detail display.<br />
To set the display options:<br />
1 Select Display Setup from the Display menu. The Display Setup<br />
dialog tabs are summarized in the following table.<br />
User’s <strong>Guide</strong> 177