1. Agilent Technologies Copyright 1999 H7211A+221 v3.0 5-1 Capture Filters, Logging, and Subnets: Module Objectives Create capture filters that control whether frames are stored in the Advisor capture buffer or not. Set up to log data for baselining and benchmarking. Implement user defined subnet entries to tell the Advisor how to group addresses on your network.

2. Agilent Technologies Copyright 1999 H7211A+221 v3.0 5-2 Advisor Block Diagram RISC CPU MAIN CPU C O U N T E R S Network Interface Capture Buffer SYSTEM RAM Windows 98 GUI Specialized Hardware Line Vital Statistics PC Display Filters Max of 26 MB Capture Filters

3. Agilent Technologies Copyright 1999 H7211A+221 v3.0 5-3 Configuration (F10)

4. Agilent Technologies Copyright 1999 H7211A+221 v3.0 5-4 Capture Filters TCP port 80 Server Address Bad FCS DNS queries RISC CPU MAIN CPU F I L T E R S C O U N T E R S Network Interface Capture Buffer SYSTEM RAM I/O SUBSYSTEM Specialized Hardware Example Filters: Addresses Filter criteria must be matched for frames to enter the capture buffer.

5. Agilent Technologies Copyright 1999 H7211A+221 v3.0 5-5 Capture Filters Tab Go to the Capture Filters tab to define hardware filters

6. Agilent Technologies Copyright 1999 H7211A+221 v3.0 5-6 Capture Filters: Add Use Capture Filters to control the information going into the Advisor. Description: Capture only frames to or from me Filter is enabled Uses 2 of 16 resources Use Add to create a new filter Graphical display of filter usage

7. Agilent Technologies Copyright 1999 H7211A+221 v3.0 5-7 LAN Filters Give your filter a name Optional description Choose whether to include or exclude frames from the buffer. You can also start, center or halt capture when the frame is matched Use LAN Filters tab to define filter

8. Agilent Technologies Copyright 1999 H7211A+221 v3.0 5-8 LAN Filters: Creating a Station Filter Advanced Options: Can specify encapsulation, Time to Live value, Next protocol code. Expand Station Filters, Expand Addressing, Enter Addresses, Select boxes to enable. If desired, use Advanced.

9. Agilent Technologies Copyright 1999 H7211A+221 v3.0 5-9 Protocol Filters This filter stores IP and Sun and DECnet frames. The “+” indicates more ports and protocols are available. Expand Protocol Filters, Check protocols to include in the filter.

10. Agilent Technologies Copyright 1999 H7211A+221 v3.0 5-10 Frame Attributes Frame Attributes Tab: Specify frame errors and values for hex bytes. Or enter text and hex bytes are entered automatically.

11. Agilent Technologies Copyright 1999 H7211A+221 v3.0 5-11 Quick Capture Filters Copy from Decodes Summary line and Paste into Capture Filters Copy Paste Capture Filters

12. Agilent Technologies Copyright 1999 H7211A+221 v3.0 5-12 Data Logging Go to the Log Tab to set up data logging.

13. Agilent Technologies Copyright 1999 H7211A+221 v3.0 5-13 Logging Parameters Connection Statistics and Expert Analyzer log data for each event. The other measurements log data at the specified interval. Select measurements to log to file.

14. Agilent Technologies Copyright 1999 H7211A+221 v3.0 5-14 More on Log Files When you log Expert, you are also logging Commentator, Connection Stats, and Protocol Vital Stats. Commentator Connection Stats Protocol Vitals

15. Agilent Technologies Copyright 1999 H7211A+221 v3.0 5-15 Workspace Options The last settings of Workspace Options are preserved on exit, and are not changed by merging a new configuration file.

16. Agilent Technologies Copyright 1999 H7211A+221 v3.0 5-16 LAN Addresses LAN Address Display options do not apply to Decodes. Use the Display Options available in Decodes right mouse click. Custom subnet definitions LAN Addresses Default subnet definitions Advisor IP address for Active Tests

17. Agilent Technologies Copyright 1999 H7211A+221 v3.0 5-17 Subnet Mask Info 10.6.72.102 is an IP address, and 255.255.0.0 is a subnet mask. IP uses numbers (addresses) to identify networks and to identify individual components of networks called hosts (e.g., a workstation or a router). 10.6 Network Host: 72.102 Host: 72.103 Host: 72.104 These addresses are divided into 4 octets giving a total of 32 bits to work with. The 1’s in a subnet mask mark the network ID and the 0’s mark the hosts. 10.6.72.102 = 00001010. 000000110. 01001000. 01100110 255.255.0.0 = 11111111. 11111111. 00000000. 00000000 Given an IP address and a subnet mask, the network number and host number can be determined. This network ID is 10.6, this particular host is 72.102.

18. Agilent Technologies Copyright 1999 H7211A+221 v3.0 5-18 Troubleshooting Using Subnets If no User Defined Subnets were entered, this address would be 15.0.0.0 (Class A) and you would not see that 15.70.64.0 and 15.6.72.0 were separate subnets. These nodes are connected to the subnet 15.6.72.0 2,890 frames: 15.70.64.0 to 15.70.64.0 2,044 frames: 15.70.64.0 to 15.6.72.0

19. Agilent Technologies Copyright 1999 H7211A+221 v3.0 5-19 Install Application

20. Agilent Technologies Copyright 1999 H7211A+221 v3.0 5-20 Measurements Settings Measurements

21. Agilent Technologies Copyright 1999 H7211A+221 v3.0 5-21 MAC Node Stats: 50 records of 10-second intervals Commentator / Connections Stats: 100 connections and events Decodes: number of frames in capture buffer Protocol Stats Line Vital Stats 200 records of measurement intervals Protocol Vital Stats Windows of Information Note: when examining a log file, all logged records for all logged measurements are available.

22. Agilent Technologies Copyright 1999 H7211A+221 v3.0 5-22 LAB 5.1

23. Agilent Technologies Copyright 1999 H7211A+221 v3.0 5-23 Module 5: Review You can create capture filters that control whether frames are stored in the Advisor capture buffer or not. You can log data for baselining and benchmarking. User defined subnet entries tell the Advisor how to group addresses on your network.