To set up data options, click on the Data Manager button or select Options -> Data Manager...
from the menu.
Setting up Maximum Data Size
VisualSniffer stores row data of captured packets in a cache file instead of memory. Therefore, you can set Maximum Data Size
in very high number based on the space of your hard disk. If Maximum Data Size is reached, the program will take one of the following actions:
Stop capturing packets
Discard data - The program will erase all captured data and continue capturing packets
Save data to the current file or a file in the backup folder - This allows monitoring network in a long period.
Setting up filters
In the "Option" dialog, enter a filtering expression in the "Filter" field. VisualSniffer uses the libpcap filter language
for capture filters. The filtering expression syntax is explained in the tcpdump man page
www.tcpdump.org. A capture filter has the form of a series of primitive expressions connected by conjuctions (and/or)
and optionally preceeded by not:
[not] primitive [and|or [not] primitive ...]
Primitives usually consist of an id (name or number) preceded by one or more qualifiers.
There are three different kinds of qualifier:
Type - qualifiers say what kind of thing the id name or number refers to. Possible types are host, net
and port. E.g., `host foo', `net 128.3', `port 20'. If there is no type qualifier, host is assumed.
dir - qualifiers specify a particular transfer direction to and/or from id. Possible directions are
src, dst, src or dst, and src and dst. E.g., `src foo', `dst net 128.3', `src or dst port ftp-data'.
If there is no dir qualifier, src or dst is assumed. For `null' link layers (i.e. point to point protocols such as slip)
proto - qualifiers restrict the match to a particular protocol. Possible protos are: ether, fddi, tr,
ip, ip6, arp, rarp, decnet, tcp and udp. E.g., `ether src foo', `arp net 128.3', `tcp port 21'. If there
is no proto qualifier, all protocols consistent with the type are assumed. E.g., `src foo' means `(ip or arp or rarp)
src foo' (except the latter is not legal syntax), `net bar' means `(ip or arp or rarp) net bar' and `port 53' means
`(tcp or udp) port 53'.
Examples
1. |
Capturing ftp traffic to and from a particular host:
tcp port 21 and host 10.0.0.5 |
2. |
Capturing all packets from a particular host:
src host 10.0.0.5 |
3. |
Capturing packets have a source port value of 80:
src port 80 |
Logging
Log file - This is the path to where VisualSniffer will write captured packets, if you turn on
the options of "dump packets to log file". The file format is the libpcap one. This format is a standard
used by a lot of network tools.
Dump packets to log file - Select this option to have log files generated for captured packets.
Resolve Addresses
Resolve Addresses - When selected, IP addresses will be replaced by the hostnames.
When cleared, only the IP addresses are shown. Showing the hostnames adds time to the
program since it requires that the IP addresses be resolved.