To specify address pairs in a capture filter

1. Open Network Monitor.
2. If prompted, select the local network from which you want to capture data by default.
3. On the Capture menu, click Filter.
4. Double-click the AND (Address Pairs) line in the decision tree.

   Or, double-click the address pair you want to edit.

5. In the Address Expression dialog box, specify address pair properties, and then click OK.

Notes

• XOX
• XOX
• You can define up to three address pairs in a capture filter.
• In a capture filter, EXCLUDE statements take logical precedence over INCLUDE statements. Regardless of the sequence in which statements appear in the Capture Filter dialog box, Network Monitor evaluates EXCLUDE statements first. Therefore, in a filter containing both an EXCLUDE and an INCLUDE statement, if a frame meets the criteria specified in an EXCLUDE statement, Network Monitor discards the frame. Network Monitor does not test that frame against the INCLUDE statement to see if the frame also meets the criteria of the INCLUDE statement.
• When you close the capture filter, Network Monitor optimizes the logic you used in the (Pattern Matches) branch of the capture filter decision tree. Therefore, when you re-open the capture filter, it might look different from the way it did when you created it. For example, if you define multiple pattern match statements, Network Monitor automatically processes them with an implicit OR operator and removes any explicit OR operators between such statements.

Related Topics