4-25
User Guide for the Cisco Network Analysis Module (NAM) Traffic Analyzer, 5.0
OL-22617-01
Chapter 4 Capturing and Decoding Packet Data
Viewing Packet Decode Information
Step 4 Do one of the following:
• To create the filter, click Submit.
• To cancel filter creation, click Cancel.
Tips for Creating Custom Decode Filter Expressions
You can construct custom decode filter expressions using the following logical and comparison operators
listed in Table 4-12.
You can also group subexpressions within parentheses. You can use the following fields in filter
expressions:
Data Pattern The data to be matched with the packet. Enter hh hh hh ..., where hh are hexadecimal numbers from
0-9 or a-f.
Leave blank if not applicable.
Filter Expression An advanced feature to set up complex filter
conditions.
The simplest filter allows you to check for the
existence of a protocol or field. For example,
to see all packets that contain the IPX
protocol, you can use the simple filter
expression ipx.
See Tips for Creating Custom Decode Filter Expressions,
page 4-25.
Table 4-11 Custom Decode Filter Dialog Box (continued)
Field Description Usage Notes
Tab l e 4-12 Logical and Comparison Operators
Operator Meaning
and Logical AND
or Logical OR
xor Logical XOR
not Logical NOT
== Equal
!= Not equal
>Greater than
Field Filter By Format
eth.addr
eth.src
eth.dst
MAC address hh:hh:hh:hh:hh:hh, where h is a hexadecimal number from 0 to 9 or a
to f.
ip.addr
ip.src
ip.dst
IP address n.n.n.n or n.n.n.n/s , where n is a number from 0 to 255 and s is a
0-32 hostname that does not contain a hyphen.