You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
Using display and color filters on <strong>fw</strong> moni<strong>to</strong>r parameters<br />
Ethereal offers the possibility <strong>to</strong> display only specific packets and/or <strong>to</strong> display them with different colors.<br />
The easiest way <strong>to</strong> display only specific packets is <strong>to</strong> select a packet in the overview pane and select<br />
Follow TCP Stream from the context menu. This will au<strong>to</strong>matically set a display filter <strong>to</strong> only display<br />
packets of this specific connection (based on source/destination IP addresses and ports). You can see<br />
this filter below the raw data pane. Additionally it displays the data exchanged between client and server<br />
in a separate dialog box:<br />
Figure 64: Ethereal – Follow TCP Stream<br />
The display filter in this case is:<br />
(ip.addr eq 10.2.4.12 and ip.addr eq 172.16.1.1) and (tcp.port eq 41748 and tcp.port eq 80)<br />
Figure 65: Ethereal – TCP Stream display filter example<br />
! Please note that this filter only <strong>use</strong>s IP addresses and ports. Therefore you will still have all four<br />
lines per packet in the overview pane. An exception might be if you are using NAT (where the<br />
addresses might change inbound and/or outbound) or if you <strong>use</strong>d capture masks (Capture masks)<br />
while creating the capture file.<br />
<strong>How</strong> <strong>to</strong> <strong>use</strong> <strong>fw</strong> moni<strong>to</strong>r Page 51 of 70<br />
Revision: 1.01
Change language