Sniffer® Portable Professional User's Guide - NetScout

Chapter 8
Using Protocol Forcing
You can define up to four
rules. Checked rules are
enabled and applied to
decoded data.
198 Sniffer Portable Professional
Protocol forcing is useful when capturing frames that use a mixture of
standard and non-standard (for example, proprietary) protocols that the
Sniffer Portable Professional might not otherwise be able to decode. For
example, in some situations, networks may include standard IP data
within a proprietary lower layer packet format unknown to the analyzer.
Protocol forcing essentially lets you tell the analyzer “if you see this
condition, skip this many bytes (to where the standard data is), then
apply this protocol interpreter.”
You specify protocol forcing rules in the Protocol Forcing tab of the
Options dialog box, displayed by selecting the Options command from
the analyzer's Tools menu (sample shown in Figure 8-17).
Use the drop-down list to specify the protocol that should
be used as the “force from” protocol. When the analyzer
encounters the condition specified here, it will skip the
number of bytes specified in the Skip x bytes field and
apply the protocol interpreter specified in the Then field.
Figure 8-17. Defining Protocol Forcing Rules
Specify the number of
bytes to skip once the “If”
condition is detected.
Use the drop-down list to
specify the protocol that
should be used as the
“force to” protocol (that is,
the protocol to be
expected at the offset you
specified in the Skip x
bytes field).