Hub/Switch Reference Guide
Snoop Commands 577
Nortel WLAN—Security Switch 2300 Series Command Line Reference
set snoop
Configures a snoop filter.
Syntax
set snoop filter-name [condition-list] [observer ip-addr] [snap-length num]
Defaults
No snoop filters are configured by default.
Access
Enabled.
filter-name Name for the filter. The name can be up to 15 alphanumeric characters,
with no spaces.
condition-list Match criteria for packets. Conditions in the list are ANDed. Therefore, to
be copied and sent to an observer, a packet must match all criteria in the
condition-list. You can specify up to eight of the following conditions in a
filter, in any order or combination:
• frame-type {eq | neq} {beacon | control | data |
management | probe}
• channel {eq | neq} channel
• bssid {eq | neq} bssid
• src-mac {eq | neq | lt | gt} mac-addr
• dest-mac {eq | neq | lt | gt} mac-addr
• host-mac {eq | neq | lt | gt} mac-addr
• mac-pair mac-addr1 mac-addr2
To match on packets to or from a specific MAC address, use the dest-mac
or src-mac option. To match on both send and receive traffic for a host
address, use the host-mac option. To match on a traffic flow (source and
destination MAC addresses), use the mac-pair option. This option
matches for either direction of a flow, and either MAC address can be the
source or destination address.
If you omit a condition, all packets match that condition. For example, if
you omit frame-type, all frame types match the filter.
For most conditions, you can use eq (equal) to match only on traffic that
matches the condition value. Use neq (not equal) to match only on traffic
that is not equal to the condition value.
The src-mac, dest-mac, and host-mac conditions also support lt (less
than) and gt (greater than).
observer ip-addr Specifies the IP address of the station where the protocol analyzer is
located. If you do not specify an observer, the AP radio still counts the
packets that match the filter.
snap-length num Specifies the maximum number of bytes to capture. If you do not specify
a length, the entire packet is copied and sent to the observer. Nortel
recommends specifying a snap length of 100 bytes or less.