Finisar Surveyor, User Manual

Page: 145 / 454

7-9
Capture and Display Filters
Creating Filters with Filter Templates
7
You then save the template. When you save a custom template, Surveyor asks for a
custom template name. Surveyor will assign a default name such as
Template1
if
no name is provided.
Once you create a filter template, its name will appear in the
Custom_Templates
section of the
Available Filter Templates
box. Custom tem-
plates can be reused again and again once added to the list of templates. You must
use the
Add
button so the filter template name appears in the
Template Combination
box for the template to be used in the current filter.
Custom Templates Based on Specification of Byte Patterns
You can create custom templates by entering values in the offsets within the
Current
Filter Template Display
area. The small fields in this area define the data patterns
that comprise a filter template. The offset defines the position within the packet to
start comparing the packet contents with the values in the pattern. If a match occurs,
then this portion of the condition is satisfied. The pattern can be specified as a deci-
mal, hexadecimal, or ASCII value.
Use the
Data Format
pull-down box on the right to specify if the pattern is in deci-
mal, hexadecimal, or ASCII. Use the
Offset Format
pull-down box to specify if the
column and row headers display in decimal or hexadecimal. Note that although you
can display the data in different formats, all formats use a byte boundary. Only byte
quantities can be entered or displayed.
Any specific value you create for filter templates can have “don't care” values. For
example, assume you're only looking for
FF34
in the first two bytes of the MAC
destination address. You could specify the values in your filter as
FF34XXXXXX
,
where X indicates you don't care about the values in the last three offsets. Note that
for IP addresses using decimal values you can only use
X
characters for complete
sub-addresses. For example,
128.XXX.2.2
is allowed, but
128.12X.2.2
is not
allowed.
The hex or decimal patterns display in black or magenta. The magenta color indi-
cates the bytes are a macro pattern, such as the logical OR of two different patterns,
or a conversation. Displays in magenta within the
Current Filter Template Display
area do not provide a complete view of the filter template. The
Template Descrip-
tion…
information box provides complete details about any macro pattern. Use the
Template Description…
button to see the exact offsets, patterns, and logical opera-
tors you have used to create the filter template. Many ASCII patterns have no corre-
sponding display character.
Use the
Template Description
button to see the exact offsets, patterns, and logical
operators you have used to create the filter template. See Figure 7-2 for an example
of this window.