Advanced Filters

In addition to make simple filters by address, port and protocol, you can set packet size, packet value, packet pattern and logical relations as filter parameters to create advanced filters.

The filters you created will be arranged in a filter relation map. The map shows you the logical relations among the conditions from adapter to Colasoft Capsa project.

For advanced filters have more filter conditions than simple filters, simple filters can be converted to advanced filters. Some filter conditions, however, will be lost if you convert an advanced filter to a simple filter.

For example, you can create an advanced filter to monitor BT downloading in a network segment as figure below:

This filter contains three conditions:

• First condition: Match a network segment "192.168.0.1 - 192.168.0.200".
• Second condition: Exclude an IP address "192.168.0.65".
• Third condition: Match one of packet patterns: (1) Content: Type "Hex", "Pattern" value "13426974546f7272656e742020726f746f63616c" or (2) "Port Range" from 6881 - 6889.

Following the process of the figure below, Colasoft Capsa compares against captured packets with the conditions. If a packet matches the criteria, it is recognized as BT downloading packet.

Toolbar

The Toolbar contains the following icons:

Filter Conditions

Advanced filters let you set precise parameters so that Colasoft Capsa can almost capture any packet you need. For example, you can create advanced filters as follows:

• Value
• Size
• Pattern

Packet value filter

Packet size filter

Packet pattern filter