3Com WX4400 3CRWX440095A manual Displaying Configured Snoop Filters, Editing a Snoop Filter

Remotely Monitoring Traffic 641

Displaying Configured Snoop Filters

To display the snoop filters configured on the WX switch, use the following command:

display snoop info [filter-name]

The following command shows the snoop filters configured in the examples above:

WX1200# display snoop info snoop1:

observer 10.10.30.2 snap-length 100 all packets

snoop2:

observer 10.10.30.3 snap-length 100 frame-type eq data

mac-pair (aa:bb:cc:dd:ee:ff, 11:22:33:44:55:66)

Editing a Snoop Filter

To edit a snoop filter, you can use the display configuration area snoop command to display the filter’s configuration command, then use cut-and-paste to reconstruct the command.

Deleting a Snoop Filter

To delete a snoop filter, use the following command:

clear snoop filter-name

Mapping a Snoop You can map a snoop filter to a radio on a MAP. To map a snoop filter to Filter to a Radio a radio, use the following command:

set snoop map filter-nameap apnumber radio {1 2}

You can map the same filter to more than one radio. You can map up to eight filters to the same radio. If more than one filter has the same observer, the MAP sends only one copy of a packet that matches a filter to the observer. After the first match, the MAP sends the packet and stops comparing the packet against other filters for the same observer.

If the filter does not have an observer, the MAP still maintains a counter of the number of packets that match the filter. (See “Displaying Remote Traffic Monitoring Statistics” on page 643.)