Feature # 3: Setting filters in capture windows

EtherPeek NX™

> ## Feature # 3: Setting filters in capture windows

> #### Pinpointing traffic of interest

> Filters let you focus on specific traffic. If you want to check a problem between two particular devices, perhaps a computer and a printer, address filters can capture just the traffic between these two devices. If you are having a problem with a particular function on your network, a protocol filter can help you home in on traffic related to that particular function.

> Filters work by testing packets against the criteria specified in the filter. Packets whose contents or other attributes meet these criteria are said to "match" the filter. Filters are discrete individual tools that can be saved, imported, exported, edited, and used in combination with one another. You can build filters to test for just about anything found in a packet: addresses, protocols, sub-protocols, ports, error conditions, and more.

> Filters are so easy to create in EtherPeek NX that you can often create a custom filter on-the-fly while analyzing suspect traffic on your network and use that filter to narrow your search in real time.

> ### Define and set a filter based on address and protocol

> An address filter matches traffic between specific network devices, or traffic between one specific device and all others. Protocol filters let you focus on particular types of traffic or network functions. In this example, we define a simple filter that matches all the traffic in a particular protocol (Kerberos) travelling to or from one interface (physical address) of a server.

> To create a new simple filter defining an address and protocol:

> 1. Open the Filters view of a Capture window, or choose View > Filters from the main menu to open the Filters window.
> 2. Click the Insert button to open the Edit Filter dialog in its default Simple filter view.

> Note: The Type drop-down list at the upper right of the Edit FIlter dialog allows you to choose between Simple and Advanced views. The Advanced view provides additional filter parameters and the ability to nest multiple tests in a single named filter using logical AND, OR and NOT. For this example, the Simple view does everything we need to do.

> 1. Enter a name in the Filter field. This will appear in all filter lists.
> 2. Click in the Color control to choose a color for the filter, or accept the default (black).
> 3. Optionally, enter a comment in the Comment field. You can sort filter lists by the Filter or the Comment column.
> 4. Check Address filter to enable the address section of the filter.
> 5. Choose Physical from the address Type drop-down list to define the type of addresses to be entered. (Your other choices are: IP, IPv6, AppleTalk, DECnet, or IPX.)
> 6. In Address 1, enter the physical address (MAC address) of the server NIC. Physical addresses are entered in pairs of hexadecimal characters (0-9, a-f) separated by colon characters. If this address is already entered in the Name Table, you can click the button to the right of the field and choose the entry from there.
> 7. Under Address 2, click the radio button labelled Any address.
> 8. Click the button in the center of the Address filter section and choose Both directions from the drop-down list.
> 9. Check Protocol filter to enable the definition of that aspect of the filter.
> 10. Click the Protocol... button to open the Protocol Filter dialog.
> 11. Choose ProtoSpecs from the drop-down list at the top to choose that method of defining your protocol.
> 12. Navigate the nested hierarchy of protocols to select Kerberos (Ethernet Type 2 > IP > TCP > Kerberos), then click OK to accept your selection and close the Protocol Filter dialog, returning to the Edit Filter dialog.

> Note: Most IP stacks are implemented as Ethernet Type 2. If your network uses versions of IP implemented under 802.3 instead, choose IEEE 802.3 > SNAP > IP > TCP > Kerberos.

> 1. Click OK to accept your changes and close the Edit Filter dialog. The new filter will appear in all filter lists.
> 2. To activate the new filter in your Capture window, open its Filters view, and check the checkbox beside the new filter's name. To capture only traffic matching the filter -- in this case, Kerberos traffic moving to or from the physical address or your server, click the Accept Matching button in the Filters view. The filter takes effect immediately, even if capture is already under way.

> To match all the traffic on any of the interfaces of a multi-homed server, you could create a separate simple filter matching each interface. When capturing from a segment that could have traffic to or from any of these interfaces, enable these filters and click Accept Matching. A packet matching any of the enabled filters is considered a match, and accepted into the capture buffer.

> ### Make Filter

> An easy way to create a new filter is to use the Make Filter command, available as the Make Filter button in many windows, or from the context menu (right-click) where applicable. The Make Filter command creates a filter based on the selected packet or statistics item. Make Filter can also be used in the Name Table to create a filter based on the selected named node, protocol, or port. It can also be used in the Packet Decode window (or the decode panes of the Packets view of a Capture window or Packet File window) to create a filter based on the selected data item.

> When you use the Make Filter command, an unnamed filter is created matching the parameters of the selected packet, node, protocol, conversation, or packet decode item. An Edit Filter dialog will open with the parameters for your selection already loaded. Use this dialog to make any additional changes, and save the filter under a new name.

> If multiple items are selected, the Make Filter command will attempt to create a filter for each one.

WildPackets, Inc.
http://www.wildpackets.com
Voice: (800) 466-2447
Fax: (925) 937-2479
sales@wildpackets.com