Sniffer® Portable Professional User's Guide - NetScout

Chapter 10
Setting Filter Options in the Data Pattern Tab
230 Sniffer Portable Professional
Use the Data Pattern tab to define a filter that will only capture or
display packets that match a data pattern you specify. A data pattern
filter can be simple, consisting of a single data pattern, or very
sophisticated, involving multiple data patterns connected by Boolean
operators AND, OR, and NOT.
NOTE: A complex filter is limited to no more than 20 Boolean
operators and data patterns.
A data pattern is:
A particular sequence of bits
The length of the sequence
Its offset position within the packet
The maximum data pattern length is 32 octets. You can specify the
offset from the beginning of the packet or from the protocol boundary.
You can copy the data pattern for your filter from the display decode
screen. To do this, select the packet before you invoke the define filter
function. In the Data Pattern tab, select Add Pattern, then Set Data.
This copies the data field from the selected packet into the data pattern
fields, and calculates the offset and length. In addition, you can use the
selected pattern as a template, editing it in the display to suit your
needs.
To construct a complex data pattern filter, link data patterns using
Boolean operators. The result is displayed in a tree-like diagram on the
Data Pattern tab.
The Data Pattern tab displays the work space for creating your filter,
and displays the current data pattern equation. The buttons below the
display control the process of defining the Boolean expression and data
patterns.
Figure 10-4 shows the Data Pattern tab of the Filter Settings dialog
box.