Introduction

Until now, you have used a few filters that have been vaguely explained. At this point, you need to walk through the granular details of filtering, which is the purpose of this chapter.

You might have toiled with a sniffer or some other protocol analysis device in the past. You simply pushed the Go or Start button, captured everything that came into the buffer, and then displayed it all after counting backward from 100. Although this description might seem silly, it s not bad. Actually, doing it that way might show you how many different protocols you have crossing the wire or the intensity of some compared with others. Now that you have this information, how would you find out if a specific client is actually connecting to a designated server when launched? If you did not filter the data captures, you could be sifting through literally hundreds of captured frames looking for a specific IP address and the synchronization between that client and the server. Why not simply look for those two IP addresses or MAC addresses? You can, and you will. You can also use filtering to capture only specific protocols within a suite or entire protocol suites at a time.

What Is Filtering, and Why Filter?

As the Wordsmyth Educational Dictionary states, filtering is the process of removing impurities from something by using a filter in other words, separating substances with the help of a filter. The simplest filter that you can think of is a piece...