Sniffer® Portable Professional User's Guide - NetScout

More on Data Pattern Filters
Defining Filters and Triggers
A data pattern filter can be created from a single data pattern or from
multiple data pattern definitions that are connected together by
AND/OR/NOT Boolean operators. A complex filter can contain no more
than 20 Boolean operators and data patterns.
A data pattern is defined by a particular sequence of bits, the length of
these bits, and the pattern's offset position within the packet. You have
the option of specifying the offset from the beginning of the full packet
or from the first level protocol boundary. The maximum data pattern
length is 32 octets.
The beginning octet location of a protocol boundary from the packet may
vary depending upon the media type, (Ethernet), or the DLC format
(Ethernet II, 802.2, 802.2 SNAP) it uses. IPX protocol is a good example.
It starts from offset byte 14 in an Ethernet II-type packet, but from byte
17 in an 802.2-type packet. Since Sniffer Portable Professional
recognizes various DLC format types and is able to mark the protocol
boundary correctly, using the protocol layer boundary as a starting
location for calculating the offset allows you to capture protocol packets
with a pattern filter from different network media or with different DLC
formats.
To facilitate the definition of a data pattern, Sniffer Portable Professional
allows you to 'copy' the data pattern of your choice from a known
packet. To do this, you must be in the packet decode viewer, and have
selected a particular packet before you invoke the Define Filter profiler.
Use Add Pattern/Set Data in the Data Pattern tab to copy a known data
field from the decoded packet into the data pattern fields. This will
automatically calculate the offset and length, fill the data pattern, and
suggest a default field name.
Use AND/OR/NOT Boolean operators to construct a complex data
pattern filter. The result is displayed in a tree-like diagram to show the
logical relationships.
The best way to learn how to construct a Boolean Data Pattern filter is
to start from a simple data pattern filter. The first step is to write down
the logical relationships in a Boolean equation. Next, clarify the Boolean
operation's precedence by using parenthesis liberally, so that the final
equation can be constructed using a binary-tree diagram.
The following example demonstrates how to construct the sample filter,
My Subnet. (My Subnet is also listed in the sample Boolean Data Pattern
filters supplied in Sniffer Portable Professional capture profiles.)
Suppose that you want to capture all IP traffic except traffic to and from
subnet 36.56.0. The first step is to write down a data pattern Boolean
equation that represents this operation:
Not (Src Subnet 36.56.0 OR Dest Subnet 36.56.0)
User’s Guide 233