Cisco Systems NAM, 5 manual Editing a Software Capture Filter, To edit software capture filters

Chapter 4 Capturing and Decoding Packet Data

Sessions

Table 4-5	Software Filter Dialog Box (continued)
Field		Description	Usage Notes
VLAN Identifier(s)		The 12-bit field specifying the	Choose a VLAN Range or enter from one to four individual
		VLAN to which the packet belongs.	VLAN IDs.
			For better performance, use as narrow a range as possible. The
			VLAN ID can range from 1-4095.
Application1		Select the Application radio button	Select one or more protocols to capture from the Application
		to filter by application.	drop-down list.
			Use Shift + Click to select multiple protocols.
Port		Select the Port radio button to filter	In the Source Port(s) field, enter one or more ports separated by
		by Port.	commas.
			In the Destination Port(s) field, enter one or more ports separated
			by commas.
			From the IP Protocol pull-down menu, choose TCP, UDP, or
			SCTP. No selection (default) means that any will be allowed.

1.The application filter can be used to filter on the highest layer of the protocol parsing; that is usually a layer 4 protocol (based on port). If you want to filter on the transport protocol (for example, UDP or TCP), you will need to use the “IP Protocol” selector. Selecting, for example, TCP in the “IP Protocol” selector will filter on all packets using TCP.

Note The parameters described in the table above are independently evaluated by the NAM. Therefore, the NAM will allow you to enter parameters that are contradictory, but you will not be able to get meaningful results if they do not match.

For example, the parameters Network Encapsulation and Source/Destination Address are independently evaluated. If a filter is specified with contradicting parameters such as “Network Encapsulation=IP4” and “Source Address=an IPv6 address”, it will never match any traffic, and the result will be 0 packets captured.

Step 4 Click the Submit button to create the filter, or click Cancel to close the dialog box without creating a software filter.

Editing a Software Capture Filter

To edit software capture filters:

Step 1 Choose Capture > Packet Capture/Decode > Sessions.

The Software Filters box is displayed at the bottom of the page.

Step 2 Choose the filter to edit, then click Edit.

The Software Filter dialog box (see Table 4-5 on page 4-9) is displayed.

Step 3 Enter information in each of the fields as appropriate.

Step 4 Do one of the following:

•To apply the changes, click Submit.

	User Guide for the Cisco Network Analysis Module (NAM) Traffic Analyzer, 5.0
OL-22617-01		4-11