Packet capture filters using AppNeta's Usage Module

Products

• AppNeta

Issue/Introduction

We're trying to run a packet capture in AppNeta, and we would like to filter the capture.   What is the correct syntax?

Resolution

AppNeta uses libpcap for the capture, and the supported syntax can be found by clicking the " i " icon in Product:

In to the Capture Filter section, you can try imputing some of the following filters (you will need to omit quotations):

"host 172.16.0.5" captures only traffic to or from host 172.16.0.5
"net 172.16.0.0/24" or "net 172.16.0.0 mask 255.255.255.0" captures traffic to or from a range of IP addresses
"src net 172.16.0.0/24" captures traffic from a range of IP addresses
"src net 172.16" captures all traffic from IP range 172.16.XXX.XXX
"dst net 172.16.0.0/24" captures traffic to a range of IP addresses
"port 53" captures only DNS (port 53) traffic
"port not 53 and not arp" captures all except DNS and ARP traffic
"ip" or "udp" or "tcp" captures only IP, UDP, or TCP traffic respectively
"not tcp and not icmp" captures all except TCP and ICMP traffic
"not tcp port 22" captures all except SSH (port 22) traffic
"host www.example.com and not (port 80 or port 25)" captures non-HTTP and non-SMTP traffic on your server

 

 

Additional Information

Additional details on managing packet captures can be found here:

https://techdocs.broadcom.com/us/en/ca-enterprise-software/it-operations-management/appneta/GA/analyze-results/network-usage-monitoring-usage/usage-capture.html#title-managing-packet-captures_use-an-existing-packet-capture-as-a-template