4-15
User Guide for the Cisco Network Analysis Module (NAM) Traffic Analyzer, 5.0
OL-22617-01
Chapter 4 Capturing and Decoding Packet Data
Files
• Enter a Mask of up to four bytes (eight hex characters).
Step 7 Repeat Step 6 for up to four payload data segments.
Note Only one payload segment (one row) is required. Be careful not to create overlapping payload segments.
If overlapping segments have different values the filter will never match anything due to the inherent
AND logic.
Step 8 Click Submit.

Payload Data

To configure a Payload Data hardware filter:
Step 1 Enter a Filter Name.
Step 2 From the Type drop-down menu, choose Payload Data.
Step 3 Choose an IP Protocol, either TCP or UDP.
Step 4 Enter the values for Payload Data:
• Enter an Offset from 1-1023. The offset is relative to the beginning of the payload (Layer 5).
• Enter a Value of up to four bytes (eight hex characters).
• Enter a Mask of up to four bytes (eight hex characters).
Step 5 Repeat Step 4 for up to four payload data segments.
Note Only one payload segment (one row) is required. Be careful not to create overlapping payload segments.
If overlapping segments have different values the filter will never match anything due to the inherent
AND logic.
Step 6 Click Submit.
Files
Use the Files option to decode, download, rename, convert/merge, delete, analyze, or error-scan saved
capture files. See the section Sessions, page 4-2 and Table 4-2 for information about how to save capture
sessions to files. You can download files in either .enc or .pcap file formats. See Preferences, page 5-13,
for information about setting the download file format.
Caution If you have capture files with a state of Full and the NAM is rebooted, the capture will be triggered again
and these files may be overwritten by the new capture. If you want to retain the file, save the file before
rebooting.
Choose Capture > Packet Capture/Decode > Files to display the Capture Files window. The Capture
Files window shows the following information: