Filter
Top Products
702 CHAPTER 22: SNOOP COMMANDS
To match on packets to or from a specific MAC address, use the
dest-mac or src-mac option. To match on both send and receive
traffic for a host address, use the host-mac option. To match on a
traffic flow (source and destination MAC addresses), use the mac-pair
option. This option matches for either direction of a flow, and either
MAC address can be the source or destination address.
If you omit a condition, all packets match that condition. For example,
if you omit frame-type, all frame types match the filter.
For most conditions, you can use eq (equal) to match only on traffic
that matches the condition value. Use neq (not equal) to match only
on traffic that is not equal to the condition value.
observer ip-addr — Specifies the IP address of the station where
the protocol analyzer is located. If you do not specify an observer, the
MAP radio still counts the packets that match the filter.
snap-length num — Specifies the maximum number of bytes to
capture. If you do not specify a length, the entire packet is copied and
sent to the observer. 3Com recommends specifying a snap length of
100 bytes or less.
Defaults — No snoop filters are configured by default.
Access — Enabled.
History —Introduced in MSS Version 4.0. Version 6.0 added the direction
filter.
Usage — Traffic that matches a snoop filter is copied after it is decrypted.
The decrypted (clear) version is sent to the observer.
For best results:
Do not specify an observer that is associated with the MAP where the
snoop filter is running. This configuration causes an endless cycle of
snoop traffic.
If the snoop filter is running on a Distributed MAP, and the MAP used
a DHCP server in its local subnet to configure its IP information, and
the MAP did not receive a default gateway address as a result, the
observer must also be in the same subnet. Without a default gateway,
the MAP cannot find the observer.