Filter
Top Products
7-10
Surveyor
User’s Guide
Entering Values that Cross Byte Boundaries
Port values are generally understood as decimal numbers. For example, an NFS port
is known as decimal 2049. Filter patterns are expressed as bytes and begin on byte
boundaries. It takes two bytes to express a port number. Therefore, for port numbers
you must convert the decimal number to a value that can be entered on a byte
boundary. The example below shows how to enter NFS port 2049 in the filter win-
dow.
1. Take the port number (2049) and divide by 256. The result is 8 remainder 1. In
IP “dot” notation, this could be expressed as “8.1”.
2. Set the Data format pull-down box in the filter window to Decimal. Values in
the Data pattern area will be entered in decimal.
3. Enter 8 in offset 34 and enter 1 in offset 35. Enter 8 in offset 36 and 1 in offset
37. This sets the filter for both source and destination port.
If a port number is a decimal value less than 256, then the value of the first byte of
the port number is zero, and the second byte is the decimal port number. For exam-
ple, for HTTP port 80, enter zero in offset 34 and 80 in offset 35.
The byte-boundary restriction applies to any other decimal number, such as a num-
ber in a data pattern, that you want to filter on. You must first convert it so the value
is expressed using byte boundaries.