Network Instruments Observer User Manual

Page 19

Packet Capture

Observer filters allow you to capture packets coming from one hardware

address to another, from one IP address to another, from a hardware address

to an IP address, or from an IP address to a hardware address—in one or both

directions: all incoming packets to a particular address from any source, all

outgoing packets from a particular address to any destination, or all the traffic

on the network—subject to the protocol subfilter. In addition, Observer

allows “exclude” directional settings. This would specifically exclude one

address to another, in either direction. The exclude arrows are the opposite of

include arrows. Additionally, you can capture only error packets by selecting

the “Error” filter.

Exclude filters take precedence over include filters. If a packet is
marked for inclusion by one filter and for exclusion by another, it will be
excluded.

1. To create or edit a filter entry, right-click on the desired filter in the

Configured Address Filter column.

2. Click on the C

REATE

ILTER

NTRY

or E

DIT

ELECTED

ILTER

NTRY

button to display the Add/Edit Address Filter Entry dialog.

3. Select a Network Address Type by selecting the E

THERNET

, T

OKEN

ING

FDDI option button or the F

RAME

ELAY

option button.

4. Select a filter address type by selecting the H

ARDWARE

ADDRESS

option

button or the IP

ADDRESS

option button from Address 1 Type and

Address 2 Type. You can select a hardware filter or IP filter

independently for source or destination.

5. Right-click on the “Address 1” or “Address 2” textboxes to display a

popup list of available addresses. Click on the address you want to

capture or exclude. You may also type in an address you wish to capture

or exclude.
The “Address 1” and “Address 2” list boxes show the addresses (and

aliases) that you may want to monitor. You can create as many entries as

you have on your LAN. However, you can only set a filter to monitor up

to five addresses at a time.
The format of an address entry is either the six numbers of the Ethernet

address separated by colons or dots or the Token Ring address. An alias

is a name that Observer will substitute for an address when showing the

headers of incoming packets (if you tell Observer to use aliases). This can

make packets easier to recognize and analyze (e.g., 00:02:8A:49:B2:48

David Jones).