Surveyor User's Guide

7-12
Surveyor
User’s Guide
Filter Creation
The FILTER CREATION portion (left side) of the Filter Design window is the area that
actually specifies what conditions are tested and what actions are taken for this filter
statement. See Figure 7-1 for an example of the
FILTER CREATION area.
•
Create Template Combinations
A template combination is built up from various custom or pre-defined filter
templates. Logical operators such as AND, OR, and NOT are used to create the
logic sequence. Use the operator buttons below the
Template Combination box
to add operators and use the
Add button to insert filter templates.
•
Set Filter Actions and Custom Counters
Press the Set Filter Actions and Custom Counters button to set actions and incre-
ment counters. The
Filter Actions dialog box allows you to perform actions that
go beyond simple packet capture or display, such as incrementing counters, set-
ting a trigger position, or changing the operational state of the filter. The default
setting is to capture the packet (if the filter template conditions are true) and
continue.
•
Add Counter Conditions
A counter condition is a special condition for accepting/rejecting a packet based
on a counter value. Logically, a counter condition functions like a filter tem-
plate. The settings for counters are test values that can be compared to actual
packet counts and thereby determine subsequent actions.
•
Filter Packet Types
Four types of frames can be collected and displayed. Refine your selection crite-
ria by selecting only a subset of all frame types. If all boxes are checked, all
frame types will pass the filter unless rejected by the other filter criteria you
have specified in the
Template Combination box.
Creating Filter Template Combinations
A template combination provides a way to create a more refined search for specific
data. The template combinations are built by selecting a combination of filter tem-
plates, operators, and custom counters. An example template combination is shown
below:
MAC_Source_Aaddress AND (SMTP OR FTP)
The Template Combination box shows the syntax for the condition. Double-click on
filters templates or single-click on operators (buttons) and they appear in the
Tem-
plate Combination
field.
Filter templates are the primary building blocks of a template combination. A filter
template contains the patterns for creating the logical conditions that will be used as