Cisco Systems 5, NAM manual Editing Custom Display Filters, Field Filter By Format

Chapter 4 Capturing and Decoding Packet Data

Viewing Packet Decode Information

Field	Filter By	Format
tcp.port	TCP port number	A decimal number from 0 to 65535.
tcp.srcport
tcp.dstport
udp.port	UDP port number	A decimal number from 0 to 65535.
udp.srcport
udp.dstport
protocol	Protocol	Click the Protocol list in the Custom Decode Filter dialog box to see the
		list of protocols on which you can filter.
protocol [offset:length]	Protocol data pattern	hh:hh:hh:hh..., where hh is a hexadecimal number fro 0 to 9 or a to f.
		offset and length are decimal numbers.
		offset starts at 0 and is relative to the beginning of the protocol
		portion of the packet.
frame.pkt_len	Packet length	A decimal number that represents the packet length, not the truncated
		capture packet length.

Examples of Custom Decode Filter Expressions

•To match SNMP packets from 111.122.133.144, enter:

snmp and (ip.src == 111.122.133.144)

•To match IP packets from the 111.122 Class B network, enter:

ip.addr == 111.122.0.0/16

•To match TCP packets to and from port 80, enter:

tcp.port == 80

•The TOS value is stored in byte 1 (the second byte) in the IP header. To match the IP packet with the TOS value 16 (0x10), enter:

ip[1:1] == 10

•The TCP acknowledgement number is stored in bytes 8 through 11 in the TCP header. To match the TCP packet with acknowledgement number 12345678 (0xBC614E), enter:

tcp[8:4] == 00:BC:61:4E

Note You can use a filter expression with other fields in the Custom Decode Filter dialog box. In this case, the filter expression is ANDed with other conditions.

Invalid or conflicting filter expressions result in no packet match.

Editing Custom Display Filters

To edit custom display filters:

Step 1 Choose Capture > Packet Capture/Decode > Display Filters.

Step 2 Choose the filter to edit, then click Edit.

Step 3 Change the information in each of the fields as appropriate.

	User Guide for the Cisco Network Analysis Module (NAM) Traffic Analyzer, 5.0
4-26	OL-22617-01