4-26
User Guide for the Cisco Network Analysis Module (NAM) Traffic Analyzer, 5.0
OL-22617-01
Chapter 4 Capturing and Decoding Packet Data
Viewing Packet Decode Information
Examples of Custom Decode Filter Expressions
• To match SNMP packets from 111.122.133.144, enter:
snmp and (ip.src == 111.122.133.144)
• To match IP packets from the 111.122 Class B network, enter:
ip.addr == 111.122.0.0/16
• To match TCP packets to and from port 80, enter:
tcp.port == 80
• The TOS value is stored in byte 1 (the second byte) in the IP header. To match the IP packet with
the TOS value 16 (0x10), enter:
ip[1:1] == 10
• The TCP acknowledgement number is stored in bytes 8 through 11 in the TCP header. To match the
TCP packet with acknowledgement number 12345678 (0xBC614E), enter:
tcp[8:4] == 00:BC:61:4E
Note You can use a filter expression with other fields in the Custom Decode Filter dialog box. In this case, the
filter expression is ANDed with other conditions.
Invalid or conflicting filter expressions result in no packet match.
Editing Custom Display Filters
To edit custom display filters:
Step 1 Choose Capture > Packet Capture/Decode > Display Filters.
Step 2 Choose the filter to edit, then click Edit.
Step 3 Change the information in each of the fields as appropriate.
tcp.port
tcp.srcport
tcp.dstport
TCP port number A decimal number from 0 to 65535.
udp.port
udp.srcport
udp.dstport
UDP port number A decimal number from 0 to 65535.
protocol Protocol Click the Protocol list in the Custom Decode Filter dialog box to see the
list of protocols on which you can filter.
protocol [offset:length]Protocol data pattern hh:hh:hh:hh..., where hh is a hexadecimal number fro 0 to 9 or a to f.
offset and length are decimal numbers.
offset starts at 0 and is relative to the beginning of the protocol
portion of the packet.
frame.pkt_len Packet length A decimal number that represents the packet length, not the truncated
capture packet length.
Field Filter By Format