System information

156 The Statistics Menu
Sequence of Bytes at Offset
This trigger allows you to set a trigger on a user-defined event.
• “Sequence (hexadecimal)” textbox—allows you to set the actual packet
information to look for. This is entered as hexadecimal codes. This sequence is
non-byte swapped (i.e., network byte order). For example, if you define an
offset-sequencing trigger to look for telnet packets (i.e., looking for TCP port
23), the offset would be 34 (14 bytes of Ethernet header + 20 more bytes of IP
header) and the sequence would be 00 17 (23 in hex).
See the section on active highlighting (in the Packet View sections of the manual) for
help on creating offsets. You can enter a specific offset from a packet’s beginning and
specific information to look for after that offset.
• “Offset from beginning” textbox—allows you to set the decimal position to start
looking for the sequence.
• “Use current protocol filter” checkbox—when selected, allows you to use the
current protocol filter.
Unknown IP Addresses
This trigger is designed to have Observer scan all packets and locate an unknown IP
address. This is useful if you have users who may inadvertently (or not) change their
IP address; thus, causing problems with any IP address strategy.
To use this trigger, you must have a “hosts” file in the Observer installation directory.
This host file should have all known IP addresses listed. Observer will compare all
newly found IP addresses to the addresses in the hosts file, and if a new address is
found, Observer will trigger the associated action.
Configuration includes the exclusion of up to three hardware addresses (usually
routers).