Filter
Top Products
7-13
Capture and Display Filters
Filter Creation
7
a test against incoming frames.
If the operation you try makes no sense in the context of creating a template combi-
nation, the operation is not allowed. For example, an OR operator makes no sense
after an AND operator. As another example, inserting a filter template immediately
after another filter template makes no sense and the operation is not allowed.
The following table describes the buttons that are used as operators to create tem-
plate combinations.
Filter Actions
The
Filter Actions dialog box is accessed by pressing the Set Filter Actions and Cus-
tom Counters
button from the Filter Design window. Actions do not need to be set
for simple filters. The
Filter Actions dialog box allows you to refine the exact con-
tents of the capture buffer that go beyond the filtering specified in the
Filter Design
window. The default setting is to capture the current packet and continue.
Table 7-3. Operator Buttons for Template Combinations
Button Description
AND Insert logical AND operator. The AND operator has a higher priority
than the OR operator (i.e., will be interpreted first).
OR Insert logical OR operator.
NOT Insert logical NOT operator.
( Insert Open Parentheses. Along with the closed parentheses, estab-
lishes the ordering and interpretation of the operands.
For example, MAC_Source_Address AND SMTP OR FTP is inter-
preted differently from MAC_Source_Address AND (SMTP OR FTP).
) Insert Closed Parentheses. Along with the open parentheses, estab-
lishes ordering and interpretation of the operands.
Clear All Clears the entire template combination box.
CE Clears the Last Entry. Erases only the last operator or template added
to the template combination.
Add Counter Condition... Brings up a dialog box to create a counter condition. You specify a
counter name and a value to test against. When you specify the counter
condition and click the OK button, the counter condition will appear in
the Template Combination box.
See the section on Counter Conditions for more information on using
counter conditions.