Specifications

22-4 Snoop Commands
set snoop
Configuresasnoopfilter.
Syntax
set snoop filter-name [condition-list] [observer ip-addr] [snap-length num]
Parameters
Defaults
Nosnoopfiltersareconfiguredbydefault.
filter‐name Nameforthefilter.Thenamecanbeupto15 alphanumericcharacters,
withnospaces.
condition‐list Matchcriteriaforpackets.ConditionsinthelistareANDed.Therefore,
tobecopiedandsenttoanobserver,apacketmustmatchallcriteria
in
thecondition‐list.Youcanspecifyuptoeightofthefollowingconditions
inafilter,inanyorderorcombination:
frame‐type{eq|neq}{beacon|control|data|management|probe}
channel{eq|neq}channel
bssid{eq|neq}bssid
src‐mac
{eq|neq|lt|gt}mac‐addr
dest‐mac{eq|neq| lt|gt}mac‐addr
host‐mac{eq|neq|lt|gt}mac‐addr
TomatchonpacketstoorfromaspecificMACaddress,usethedest‐
macorsrc‐mac
option.Tomatchonbothsendandreceivetrafficfora
hostaddress,usethehost‐macoption.Tomatchonatrafficflow(source
anddestinationMACaddresses),usethemac‐pairoption.Thisoption
matchesforeitherdirectionofaflow,andeitherMACaddresscanbe
thesource
ordestinationaddress.
Ifyouomitacondition,allpacketsmatchthatcondition.Forexample,if
youomitframe‐type,allframetypesmatchthefilter.
Formostconditions,youcanuseeq(equal)tomatchonlyontraffic that
matchestheconditionvalue.Useneq(notequal)tomatch
onlyon
trafficthatisnotequaltotheconditionvalue.
Thesrc‐mac,dest‐mac,andhost‐macconditionsalsosupportlt(less
than)andgt(greaterthan).
observerip‐addr SpecifiestheIPaddressofthestationwheretheprotocolanalyzeris
located.Ifyoudonotspecifyan
observer,theDAPradiostillcountsthe
packetsthatmatchthefilter.
snap‐lengthnum Specifiesthemaximumnumberofbytestocapture.Ifyoudonotspecify
alength,theentirepacketiscopiedandsenttotheobserver.Enterasys
Networksrecommendsspecifyingasnaplengthof100bytesorless.