Filter
Top Products
System > Packet Capture
113
SonicOS Enhanced 4.0 Administrator Guide
You can specify up to ten Ethernet types separated by commas. Currently, the following
Ethernet types are supported: ARP, IP, PPPoE-SES, and PPPoE-DIS. The latter two can
be specified by PPPoE alone. This option is not case-sensitive. For example, to capture all
supported types, you could enter: ARP, IP, PPPOE. You can use one or more negative
values to capture all Ethernet types except those specified; for example: !ARP, !PPPoE.
You can also use hexadecimal values to represent the Ethernet types, or mix hex values
with the standard representations; for example: ARP, 0x800, IP. Normally you would only
use hex values for Ethernet types that are not supported by acronym in SonicOS Enhanced.
See
“Supported Packet Types” on page 122.
• IP type of the packets that you want to capture
You can specify up to ten IP types separated by commas. The following IP types are
supported: TCP, UDP, ICMP, GRE, IGMP, AH, ESP. This option is not case-sensitive. You
can use one or more negative values to capture all IP types except those specified; for
example: !TCP, !UDP. You can also use hexadecimal values to represent the IP types, or
mix hex values with the standard representations; for example: TCP, 0x1, 0x6. See
“Supported Packet Types” on page 122.
• Source IP addresses from which to capture packets
You can specify up to ten IP addresses separated by commas; for example: 10.1.1.1,
192.2.2.2. You can use one or more negative values to capture packets from all but the
specified addresses; for example: !10.3.3.3, !10.4.4.4.
• Source port(s) from which to capture packets
You can specify up to ten port numbers separated by commas; for example: 20, 21, 22, 25.
You can use one or more negative values to capture packets from all but the specified
ports; for example: !80, !8080.
• Destination IP address(es) for which to capture packets
You can specify up to ten IP addresses separated by commas; for example: 10.1.1.1,
192.2.2.2. You can use one or more negative values to capture packets destined for all but
the specified addresses; for example: !10.3.3.3, !10.4.4.4.
• Destination port(s) for which to capture packets
You can specify up to ten port numbers separated by commas; for example: 20, 21, 22, 25.
You can use one or more negative values to capture packets destined for all but the
specified ports; for example: !80, !8080.
• Bidirectional address and port mapping
When this option is selected, IP addresses and ports specified here will be matched against
both the source and destination fields in each packet.
Note If a field is left blank, no filtering is done on that field. Packets are captured without regard
to the value contained in that field of their headers.