Display and Capture filter in one re: Luara Chappell

[jacob200]

Does anyone know how to trick sniffer into using the same set of filters for capture and display use? I heard that Laura Chappell often shows this "trick" but I have not seen it done yet. Any help is apprecited. Thank you.

 

[cwicker]

Page 3-77 in my TNV-101-GUI it states (in my notes from the instructor) 'Capture filters can be used in all modes; display filters can only be used in display mode. Modes are: Monitor; Capture; Display; and Triggers.'

In other words, if one were to build a capture filter, one could use the capture filter during a capture session and the same filter could also be used while in display mode.

Hope this is the answer you are looking for.
Craig
SCP

 

[cwicker]

See Laura Chappell's book "Capturing the Cool Packets", page 23:
Quote: " ...on the Sniffer, I never build display filters (right click on a trace file and select "Define Filter." I only build capture filters (click on the little magic wan on the menubar). I use these capture filters as both capture and display filters." Unquote.

And the top of page 24: Auote: " The moral of the story? Don't build display filters on the Sniffer-only build capture filters- they'll do everything you need." Unquote.