User`s manual

395
DWS-1008 User’s Manual
D-Link Systems, Inc.
Appendix A - Troubleshooting
If you omit a condition, all packets match that condition. For example, if you omit frame-type,
all frame types match the lter.
For most conditions, you can use eq (equal) to match only on trafc that matches the condition
value. Use neq (not equal) to match only on trafc that is not equal to the condition value.
The observer ip-addr option species the IP address of the station where the protocol
analyzer is located. If you do not specify an observer, the AP radio still counts the packets
that match the lter.
The snap-length num option species the maximum number of bytes to capture. If you do
not specify a length, the entire packet is copied and sent to the observer. D-link recommends
specifying a snap length of 100 bytes or less.
The following command congures a snoop lter named snoop1 that matches on all trafc,
and copies the trafc to the device that has IP address 10.10.30.2:
DWS-1008# set snoop snoop1 observer 10.10.30.2 snap-length 100
The following command congures a snoop lter named snoop2 that matches on all data trafc
between the device with MAC address aa:bb:cc:dd:ee:ff and the device with MAC address
11:22:33:44:55:66, and copies the trafc to the device that has IP address 10.10.30.3:
DWS-1008# set snoop snoop2 frame-type eq data mac-pair aa:bb:cc:dd:ee:ff
11:22:33:44:55:66 observer 10.10.30.3 snap-length 100
Displaying Congured Snoop Filters
To display the snoop lters congured on the switch, use the following command:
show snoop info [filter-name]
The following command shows the snoop lters congured in the examples above:
DWS-1008# show snoop info
snoop1:
observer 10.10.30.2 snap-length 100
all packets
snoop2:
observer 10.10.30.3 snap-length 100
frame-type eq data
mac-pair (aa:bb:cc:dd:ee:ff, 11:22:33:44:55:66)
Editing a Snoop Filter
To edit a snoop lter, you can use the show conguration area snoop command to display
the lter’s conguration command, then use cut-and-paste to reconstruct the command.
Deleting a Snoop Filter
To delete a snoop lter, use the following command:
clear snoop filter-name