System information

220 The Tools Menu
The table below lists all the rule types and setup options. A setup dialog is displayed when
you first create a rule; you can edit a rule by double-clicking its icon in the Filter Setup
rule editor. Detailed setup descriptions follow the table.
Rule Type Usage
Specify a hardware or IP address or range of addresses for
source and destination. You can also limit the rule to apply
only to packets from particular source or destination ports.
Filter for packets that have been commented by an Observer
user and saved with a capture file. Comments are useful for
annotating packets when two analysts are working on a prob-
lem together, perhaps sending each other captures from
remote sites on a corporate network. There are no setup
options. Available for post-filter only.
Specify the categories of errors you want to filter for: CRC,
Alignment, packet to small, and packet too large are
available for all network types. You can also filter for Wire-
less WEP errors if you are analyzing a wireless network. If
you are analyzing a WAN link, you can filter for WAN abort
and RBIT errors. Observer also lets you filter for Token Ring
error notifications when analyzing Token Ring networks.
This rule lets you filter for Observer-generated Expert pack-
ets. These packets will only be generated if the “Include
Expert Load information packets” box has been checked in
Mode Commands > Setup for Packet Capture. There are
no setup options. Available for post-filter only.
Specify a packet length, and whether you want to filter for
packets that are less than, equal to, or greater than that
length. You can also filter for packets that fall within a range
of length values.
This rule is useful when you need to filter for a numeric value
(or range of values) that is embedded within a byte, word or
double word.
Use this rule to filter an ASCII, hexadecimal, or binary string
starting at specified offset or within a specified range. Hexa-
decimal and binary strings allow you to filter for values
embedded within a particular byte, word, or double word if
you know the offset, either from the beginning of the packet,
or from the beginning of a particular protocol header. If you
want to filter for numeric value or range of values within a
byte or word, consider using the numeric value filter.
Specify a port or range of ports for inclusion or exclusion.
Select a protocol and field to filter on. For example, you can
filter for ICMP “Destination unreachable” messages, or the
presence of a VLAN tag.