Sniffer® Portable Professional User's Guide - NetScout

Sniffer® Portable Professional User's Guide - NetScout Sniffer® Portable Professional User's Guide - NetScout

10.03.2013 Views

Chapter 10 220 Sniffer Portable Professional In general, you work with Defined filters in the Define Filter dialog box. This section describes how to do that. Automatic filters. In some cases, filters are created automatically by Sniffer Portable Professional when you choose to view selected information. For example, you can single-out a particular station's conversations using the Visual Filter on the Matrix map display. You can also set automatic Expert Filters in many Expert window displays, as well as automatic Display filters from an active Decode tab. Automatic filters are described in the following sections: Automatic Display filters are described in Setting Display Filters on page 167. Expert filters are described in Setting Automatic Expert Display Filters on page 151 Define Filter Options for Wireless Networks Defining Filters When using Sniffer Portable Professional with a wireless adapter, the Define Filter dialog box adds several wireless-specific filtering options: The Define Filter dialog box’s Advanced tab includes wireless LAN packet types on which you can filter (for example, PLCP Errors). See Filters for 802.11 Packet Types in the Advanced Tab on page 237. The Define Filter dialog box also includes an 802.11 tab specifically for wireless LAN filtering. See Setting Filter Options in the 802.11 Tab on page 238. In general, you work with filters in the Define Filter dialog box. The type of filter is determined by its use: When selecting what traffic to monitor, the filter becomes a monitor filter. When selecting what traffic to admit into the capture buffer, the filter becomes a capture filter. When selecting what data in the capture buffer to display, the filter becomes a display filter.

Defining Filters and Triggers When you define a filter, you give it a name (known as a Profile in the application displays). You then select a filter Profile to use as a monitor, capture, or display filter (depending on whether you choose the Select Filter command from the Monitor, Capture, or Display menu). To easily differentiate different kinds of filters, use a distinctive naming convention. See Using Filter Profiles on page 222 for details. To access the Define Filter dialog box: 1 Select Define Filter from the Monitor, Capture, or Display menu. You can also click the button (located in many windows). The Define Filter dialog box lets you define capture filters to collect specific network information. When you first open the Define Filter dialog box, the Summary tab appears, summarizing the current settings for the selected filter. This tab also displays the buffer size and the buffer action (stop capture or overwrite older data when buffer is full). In addition to the Summary tab, some or all of the following tabs are available, depending on the type of network adapter in use: The Address tab lets you define filters to capture data transmitted between network nodes (or address pairs). The Port tab lets you filter traffic on IP or IPX ports. The Data Pattern tab lets you define filters that capture frames that match data patterns rules joined by AND/OR/NOT logical operators. Data pattern filters provide a generic method of defining and documenting filter conditions that can not be defined by the address and protocol filters. The Advanced tab tab lets you define filters that capture frames that belong to one or more protocol group(s). It also lets you set filters for frames falling in a specified size range and various protocol-specific frame types (for example, jabber packets on an Ethernet network). The Buffer tab lets you set various global options relating to the size of the capture buffer and what actions should be taken when the maximum size of the capture buffer is reached. You can also create filter profiles — saved combinations of one or more of the individual filters defined on the tabs listed above. See Using Filter Profiles on page 222 for details. User’s Guide 221

Chapter 10<br />

220 Sniffer <strong>Portable</strong> <strong>Professional</strong><br />

In general, you work with Defined filters in the Define Filter dialog<br />

box. This section describes how to do that.<br />

Automatic filters. In some cases, filters are created automatically<br />

by Sniffer <strong>Portable</strong> <strong>Professional</strong> when you choose to view selected<br />

information. For example, you can single-out a particular station's<br />

conversations using the Visual Filter on the Matrix map display. You<br />

can also set automatic Expert Filters in many Expert window<br />

displays, as well as automatic Display filters from an active Decode<br />

tab.<br />

Automatic filters are described in the following sections:<br />

Automatic Display filters are described in Setting Display<br />

Filters on page 167.<br />

Expert filters are described in Setting Automatic Expert<br />

Display Filters on page 151<br />

Define Filter Options for Wireless Networks<br />

Defining Filters<br />

When using Sniffer <strong>Portable</strong> <strong>Professional</strong> with a wireless adapter, the<br />

Define Filter dialog box adds several wireless-specific filtering options:<br />

The Define Filter dialog box’s Advanced tab includes wireless LAN<br />

packet types on which you can filter (for example, PLCP Errors).<br />

See Filters for 802.11 Packet Types in the Advanced Tab on page<br />

237.<br />

The Define Filter dialog box also includes an 802.11 tab specifically<br />

for wireless LAN filtering. See Setting Filter Options in the 802.11<br />

Tab on page 238.<br />

In general, you work with filters in the Define Filter dialog box. The type<br />

of filter is determined by its use:<br />

When selecting what traffic to monitor, the filter becomes a<br />

monitor filter.<br />

When selecting what traffic to admit into the capture buffer, the<br />

filter becomes a capture filter.<br />

When selecting what data in the capture buffer to display, the filter<br />

becomes a display filter.

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!