Expression dialog box: Protocol tab

Use this tab to specify the protocols that you want to find in the Frame Viewer window or to specify protocols in the display filter decision tree.

By default, all protocols are enabled, and the Expression box shows Protocol == Any. The protocols listed in this tab are those whose parsers are currently available to Network Monitor.

Expression: The address expression to search for in frames or to add to a display filter decision tree. As you select items in other areas of the dialog box, the display changes. When you click OK, the displayed expression is added to the display filter decision tree or is used as the frame search criterion. Any other changes you make are lost.
The Expression box appears regardless of which tab you select. You cannot edit the expression directly.
Enabled Protocols: The protocols to include in the display filter or to use to search for a frame.
Disabled Protocols: The protocols excluded from the display filter, which will not be used to search for a frame. If there are protocols in the frame in addition to the disabled protocols, then the frame will still be found. For example, if you disable the SMB protocol, SMB frames will be found if they contain enabled protocols.
Disable: Click to move selected protocols to the Disabled Protocols box.
Enable: Click to move the selected protocols to the Enabled Protocols box.
Disable All: Click to move all protocols to the Disabled Protocols box.
Enable All: Click to move all protocols to the Enabled Protocols box.

Other tabs in this dialog box: Address, Property

Note

To exclude all frames that contain the SMB protocol, create a line that states Protocol == SMB and put a "Not" in front of it.