Sniffer® Portable Professional User's Guide - NetScout

Chapter 10
234 Sniffer Portable Professional
If you already have a capture packet file that contains this subnet
address, you should open this file and select the packet containing the
source subnet address 36.56.0. This will substantially ease the data
entry operation later, when you define the data pattern for the subnet
35.56.0.
Next, start defining the data pattern filter by following these steps:
1 From the main toolbar, click to open the Define Filter dialog
box.
2 Click the Profiles button to open the Capture Profiles dialog box.
3 Click the New button. Enter new profile name for example, My
Subnet. Click OK.
4 Click the Done button to close the Capture Profiles dialog box.
5 Click the Advanced tab.
6 Select IP from the Available Protocols list box. This will filter out any
non-IP packets that might have the same data pattern.
7 Click the Data Pattern tab. A default AND operator is displayed.
8 Click the Add NOT button to create a NOT operator.
9 From the newly created NOT line, click the Add AND/OR to create
a new AND child operator linked to the NOT operator.
10 Click the Toggle AND/OR button to change the AND to OR.
11 From the OR line, click the Add Pattern button to invoke the Edit
Pattern dialog box.
12 Scroll the detail decode window to locate the IP source address
containing subnet 35.56.0 and highlight the field.
13 Select Protocol in the From list box. This will tell Sniffer Portable
Professional to calculate the source IP address offset from the
beginning of the IP protocol data packet.
14 Click the Set Data button to tell Sniffer Portable Professional to fill
in the source IP address field.
15 Change Len (length of subnet) from 4 to 3, and delete the 4th octet
from the data pattern field.
16 Edit the Name field to Src Subnet 36.56.0.
17 Click OK. A new data pattern Src Subnet 36.56.0 is created and
connected to the OR operator.
18 Click the OR operator again to select it.
19 Click Add Pattern to open another Edit Pattern dialog box.