U
SING
RMON9-26

The following example shows a filter expression designed to capture any errors occurring in AppleTalk packets.

While the other example shows filtering for decoded details that is designed to capture any Ethernet II packets

directed to the IP address 10.1.0.23 that have the Don’t Fragment flag set.

Packet Status The sta tus of packets to filter: Any Packets, No Errors, Any Errors, CRC/Alignment, Packets < 64
Bytes, Undersize (packets < 64 bytes, with no CRC/alignment errors), Packets > 1518 Bytes, Oversize
(packets >1518 bytes, with no CRC/alignment errors), Fragments, Jabber, Other
Name A name for this filter express ion, consisting of the selected:
Frame Type / Protocol / Upper-Layer Protocol.
Raw Data Allows you to enter a specific data pattern to filter. Select Data and input the filter pattern, select Mask
to indicate the relevant bits, then select Not Mask to indicate the bits that should match or not match.
You can check for a pattern anywhere within the first 256 bytes of a frame.
Data: The bit pattern to filter.
Mask: The relevant bits within the data.
Not Mask: Those bits in the mask to match (0) or not match (1).
Decoded Details If the frame and protocol type are specified, then you can filter specific fields directly from the frame
and protocol headers.
Load/Save As Loads a predefined filter into the filter table, or saves the current filter as a file.

Table 9-19 Filter Configuration Options

Field Description