Triggering and stopping the capture process:

The trgger may be used to stop the capture process when
a particular data frame which passes the pre-filters is
captured.  The frame is identified by a pattern
described below.  In addition, you may select how much
data is to be accepted before and after the trigger
event.

Pattern matching of the trigger:

A pattern is a 1 to 4 nibble (hex digit) value that you
enter, using the hex values 0, 1, 2, .... D, E and F
for specific four bit fields, and X for "don't care".

You may choose whether to trigger on a frame WITH the
pattern (select Equals) or WITHOUT the pattern (select
Not equals).

Pattern matching of the trigger (continued):

The offset for the pattern match may be specified to
begin either at the first byte of the frame ("Frame
relative"), or at the beginning of the LLC information
("Data relative").  The Data relative offset starts with
zero at the first byte following the source address and
optional routing information field.

Where the trigger appears in the capture buffer:

You may select one of five different positions of the
trigger within the capture buffer, with either 0%, 25%,
50%, 75% or 100% of the buffer used for data preceeding
the trigger, and the remainder used for data following
the trigger frame.

Alternatively, you may choose that the Sniffer is to
stop collecting frames when the buffer is about to
overflow, or that you want frames to be collected
continously until you press F9 or F10.  In the latter
case the trigger will not stop the capture process.

What appears on the screen

When data is being captured but a trigger has not yet
been found, the upper left corner of the screen will
say "CAPTURING".  After the trigger has been found but
more frames must be collected to position the trigger
as requested, the label will change to "TRIGGERED".

When capturing has ceased because the trigger is
correctly positioned, or the requested full-buffer
condition occured, or because you pressed F10, the
center area of the activity bar will say "STOPPED".
