Data Manager


To set up data options, click on the Data Manager button or select Options -> Data Manager... from the menu.

Setting up Maximum Data Size

VisualSniffer stores row data of captured packets in a cache file instead of memory. Therefore, you can set Maximum Data Size in very high number based on the space of your hard disk. If Maximum Data Size is reached, the program will take one of the following actions:

  • Stop capturing packets
  • Discard data - The program will erase all captured data and continue capturing packets
  • Save data to the current file or a file in the backup folder - This allows monitoring network in a long period.

    Setting up filters

    In the "Option" dialog, enter a filtering expression in the "Filter" field. VisualSniffer uses the libpcap filter language for capture filters. The filtering expression syntax is explained in the tcpdump man page www.tcpdump.org. A capture filter has the form of a series of primitive expressions connected by conjuctions (and/or) and optionally preceeded by not:
    [not] primitive [and|or [not] primitive ...]
    Primitives usually consist of an id (name or number) preceded by one or more qualifiers. There are three different kinds of qualifier:
  • Type - qualifiers say what kind of thing the id name or number refers to. Possible types are host, net and port. E.g., `host foo', `net 128.3', `port 20'. If there is no type qualifier, host is assumed.
  • dir - qualifiers specify a particular transfer direction to and/or from id. Possible directions are src, dst, src or dst, and src and dst. E.g., `src foo', `dst net 128.3', `src or dst port ftp-data'. If there is no dir qualifier, src or dst is assumed. For `null' link layers (i.e. point to point protocols such as slip)
  • proto - qualifiers restrict the match to a particular protocol. Possible protos are: ether, fddi, tr, ip, ip6, arp, rarp, decnet, tcp and udp. E.g., `ether src foo', `arp net 128.3', `tcp port 21'. If there is no proto qualifier, all protocols consistent with the type are assumed. E.g., `src foo' means `(ip or arp or rarp) src foo' (except the latter is not legal syntax), `net bar' means `(ip or arp or rarp) net bar' and `port 53' means `(tcp or udp) port 53'.
  • Examples
    1. Capturing ftp traffic to and from a particular host:
    tcp port 21 and host 10.0.0.5
    2. Capturing all packets from a particular host:
    src host 10.0.0.5
    3. Capturing packets have a source port value of 80:
    src port 80

    Logging

    Log file - This is the path to where VisualSniffer will write captured packets, if you turn on the options of "dump packets to log file". The file format is the libpcap one. This format is a standard used by a lot of network tools.
    Dump packets to log file - Select this option to have log files generated for captured packets.

    Resolve Addresses

    Resolve Addresses - When selected, IP addresses will be replaced by the hostnames. When cleared, only the IP addresses are shown. Showing the hostnames adds time to the program since it requires that the IP addresses be resolved.