Display Filters
A display filter looks at frames
that have already been captured. It looks at every frame in the capture
buffer and displays those that match the filter criteria. Frames that
do not match the filter criteria are not displayed. Display
filters allow a user to look at a subset of captured data without affecting
the capture content. There are three general classes of display filters:
- Protocol Filters
- Named Filters
- Quick Filter
Protocol Filters
Protocol filters test for the existence of a specific single layer. The system creates a protocol filter for each decoder that is loaded if that layer is encountered in a capture session.
There are also three special purpose filters that are treated as protocol filters:
- All Frames with Errors
- All Frames with Bookmarks
- All Special Information Nodes
Named Filters
- Named filters test for anything other than simple single layer existence. Named filters can be constructed that test for the existence of multiple layers, field values in layers, frame sizes, etc., as well as combinations of those things. Named filters are persistent across sessions.
- Named filters are user-defined. User-defined filters persist in a template file. User defined filters can be deleted.
Quick Filters
- Quick Filters are combinations of Protocol Filters and/or Named Filters that are displayed on the Quick Filter tab.
- Quick Filters cannot be saved and do not persist across sessions.
- Quick Filters are created
on the Quick Filter Dialog.