With traffic discovery enabled, PacketWise will automatically create classes for protocols that use Ethertype (Ethernet packet type) fields.
This shows up in the traffic tree as a class with the name: Protocol_XXXX, where XXXX is the Ethertype value.
Q. Is the value XXXX in decimal or hex notation?
A. It can be both. Use the following guide to determine the answer:
* If the number has no leading zeros and is 255 or less, it is decimal.*
If it has a leading zero (zeros) or is greater than 255, it is hex.
Examples of auto-created names:
Q. How do I manually create a class based on the Ethertype field?
A.The class must be created from the CLI (command-line interface), using the following command:
class new ParentClass ClassName inside protocol:dec/hex
For example, to classify the IPv6 Ethertype (decimal 41):
class new /Inbound IPv6_on_IPv4 inside protocol:41
class new /Outbound IPv6_on_IPv4 inside protocol:41
You must specifiy server location to create the class properly. All matching rules require server location to be specified. However, since it is an Ethertype protocol (not an IP port number), the server location does not affect the class.
For more information about accessing the CLI and using specific commands, see PacketGuide.