Display Filters

A display filter looks at frames that have already been captured. It looks at every frame in the capture buffer and displays those that match the filter criteria. Frames that do not match the filter criteria are not displayed.  Display filters allow a user to look at a subset of captured data without affecting the capture content. There are three general classes of display filters:

  • Protocol Filters
  • Named Filters
  • Quick Filter

Protocol Filters

Protocol filters test for the existence of a specific single layer. The system creates a protocol filter for each decoder that is loaded if that layer is encountered in a capture session.

There are also three special purpose filters that are treated as protocol filters:

  • All Frames with Errors
  • All Frames with Bookmarks
  • All Special Information Nodes

Named Filters

  • Named filters test for anything other than simple single layer existence. Named filters can be constructed that test for the existence of multiple layers, field values in layers, frame sizes, etc., as well as combinations of those things. Named filters are persistent across sessions.
  • Named filters are user-defined. User-defined filters persist in a template file. User defined filters can be deleted.

Quick Filters

  • Quick Filters are combinations of Protocol Filters and/or Named Filters that are displayed on the Quick Filter tab.
  • Quick Filters cannot be saved and do not persist across sessions.
  • Quick Filters are created on the Quick Filter Dialog.
     

Also see these related topics...Related Topics Link Icon