Cisco Systems NAM, 5 Tips for Creating Custom Decode Filter Expressions, Operator Meaning, Format

Chapter 4 Capturing and Decoding Packet Data

Viewing Packet Decode Information

Table 4-11	Custom Decode Filter Dialog Box (continued)
Field		Description	Usage Notes
Data Pattern		The data to be matched with the packet.	Enter hh hh hh ..., where hh are hexadecimal numbers from
			0-9 or a-f.
			Leave blank if not applicable.
Filter Expression		An advanced feature to set up complex filter	See Tips for Creating Custom Decode Filter Expressions,
		conditions.	page 4-25.
		The simplest filter allows you to check for the
		existence of a protocol or field. For example,
		to see all packets that contain the IPX
		protocol, you can use the simple filter
		expression ipx.

Step 4 Do one of the following:

•To create the filter, click Submit.

•To cancel filter creation, click Cancel.

Tips for Creating Custom Decode Filter Expressions

You can construct custom decode filter expressions using the following logical and comparison operators listed in Table 4-12.

	Table 4-12		Logical and Comparison Operators
	Operator			Meaning
	and			Logical AND
	or			Logical OR
	xor			Logical XOR
	not			Logical NOT
	==			Equal
	!=			Not equal
	>			Greater than
	You can also group subexpressions within parentheses. You can use the following fields in filter
	expressions:
Field		Filter By			Format
eth.addr		MAC address			hh:hh:hh:hh:hh:hh, where h is a hexadecimal number from 0 to 9 or a
eth.src					to f.
eth.dst
ip.addr		IP address			n.n.n.n or n.n.n.n/s , where n is a number from 0 to 255 and s is a
ip.src					0-32 hostname that does not contain a hyphen.
ip.dst
				User Guide for the Cisco Network Analysis Module (NAM) Traffic Analyzer, 5.0
OL-22617-01						4-25