Sniffer® Portable Professional User's Guide - NetScout

Chapter 10
Using a Defined Filter
Using Filter Profiles
222 Sniffer Portable Professional
You apply a named filter to one of four filter points in Sniffer Portable
Professional to select the information you want. The filter points are,
monitor, capture, display, and event.
When you apply a filter to the monitoring process, it is called a
monitor filter. It selects what information will be included in
monitor statistics.
When you apply a filter to a capture, it is called a capture filter. A
capture filter allows only certain frames or certain portions of
frames to be saved in the capture buffer. It also defines the size of
the capture buffer and what to do when the buffer is full.
When you apply a filter to the Packet Display, it is called a display
filter. The display filter lets you select what packets you want to
display. A display filter does not affect the contents of the capture
buffer. It just prevents some of the data from being displayed.
When you apply a filter to a capture trigger definition, it is called
an event filter. You use a trigger to automatically start or stop
captures based on network events and other parameters.
Tip: Implement a naming convention for your filters. Some of the
named filters you define will be specifically designed for a particular
purpose, for example, as a display filter or as a capture filter. To easily
identify different kinds of filters in your filter list, use a distinctive
naming convention.
For example, you could begin each filter name with a single-letter
descriptor:
C-name for capture filters
D-name for display filters
M-name for monitor filters
T-name for trigger event filters
Creating precise filter definitions can be a time-consuming process.
Filter profiles provide a means to save your carefully crafted filter
definitions for later use. A filter profile is a set of one or more individual
filters defined on the various tabs in the Define Filter dialog box
(Address, Port, Data Pattern, Advanced, Buffer, and so on).