Specifications

© 2006 Cisco Systems, Inc.
All rights reserved.
Product Features 2-159
NAM / Traffic Analyzer v3.5 Tutorial
© 2006 Cisco Systems, Inc. All rights reserved.
Product Features 2-159
NAM / Traffic Analyzer v3.5 Tutorial
Packet Capture and Decode
Custom Capture Filters
Packet Capture and Decode
Custom Capture Filters
Status and status masks enable you to search for the status
of Ethernet frames that are oversized or undersized or have
CRC/alignment errors.
Status and status masks enable you to search for the status
of Ethernet frames that are oversized or undersized or have
CRC/alignment errors.
Select protocol encapsulation
and protocol to base filter on.
Leave blank if filter is protocol
independent.
Select protocol encapsulation
and protocol to base filter on.
Leave blank if filter is protocol
independent.
The mask fields (Hex) enable
you to define which portions of
the data string are relevant for
filtering and which portions
can be ignored.
The mask fields (Hex) enable
you to define which portions of
the data string are relevant for
filtering and which portions
can be ignored.
The Offset (decimal) and
Base options instruct the filter
where in the packet to begin
searching for the data string.
The Offset (decimal) and
Base options instruct the filter
where in the packet to begin
searching for the data string.
Enter your data string here.
You must enter the
hexadecimal value of the data
string you want to filter on.
Enter your data string here.
You must enter the
hexadecimal value of the data
string you want to filter on.
Capture > Custom Filters > Capture Filters
Creating Custom Capture Filters
If the filters that the packet capture settings options do not provide you with enough control over filters, you
can create your own filter in the Capture > Custom Filters > Capture Filters menu.
Custom filters enable you to search for data patterns found either in the protocol headers or in the data field
of the packet. This gives you the ability to read the packet as a single hexadecimal data stream where you
can tell the NAM to capture or disregard packets that match the data pattern that you defined in the custom
filter options. To use this feature, you need to identify a few things:
• You will need to write the data pattern you are looking for in hexadecimal. Refer to the User Guide for
more instructions on hexadecimal and data pattern matching.
• You will also need to tell it where to begin the data pattern search. If you choose absolute, you are
telling the filter to beginning looking at the first bit of the packet. If you choose protocol, you are
instructing the filter to begin looking at the first bit of the protocol header.
• Status masks enable you to filter on error conditions in Ethernet frames such as oversized or
undersized frames or CRC/alignment errors. These are defined by the NAM and you must use values
assigned to each of these in order to filter by status.
Defining your own custom filters is a very powerful and complex tool that requires thought and preparation.
Refer to the Settings Chapter of the User Guide for more detailed information and instructions on defining
custom filters.