Free to try

Buy Now

Filters

The filters in Javvin Packet Analyzer decrease the packets to be analyzed and displayed, enabling you to focus on what you are really interested in. However, to get a primary impression of your network communications, you'd better not to set any filters unless you are practiced in using this program.

Javvin Packet Analyzer has two kinds of filters: global filters and project filters.

• Global filters
  Some commonly used protocols filters are predefined and listed in the Filter Table, which can be applied to the current project by clicking the Add button and select From Filter Table.... Please note that the modification to global filters must be made in the Filter Table.
  
  
  
  
• Project filters
  You can define project filters in the Project Settings - Filter page. The filters defined in this page are only applied to the current project unless you tick the Set as default settings checkbox. Javvin Packet Analyzer graphically displays project filters, you can easily accept, reject a filter or change its status. The flexibility of Javvin Packet Analyzer lets you accept some filters and at the same time reject some others: the packets matching the Accept filters will be analyzed and the packets matching the Reject filters will be discarded.
  
  

This chapter describes how to create, modify, and use filters for network analysis, you may also find some examples which can help you be familiar with filters more quickly.

Adding a project filter

Click the filter icon  in the toolbar to open the Project Settings - Filter page, to add a project filter, you can choose to create a new one or select from the global Filter Table with predefined filters listed.

• Add a new filter
  Click on the Add button and select New... to enter the filter setting page. The Simple Filter tab lets you quickly make the most commonly used filters by address, port and/or protocol. For example, if you check the box of Address filter, select IP address and enter 192.168.6.100 in Address 1, keep Both directions and select IP address and enter 221.236.12.213 in Address 2 , after you confirm your operation and return to the previous page, you can see the filter you just define listed with a tick indicating that it is accepted. After click Ok to confirm again, only the packets transmitted between 192.168.6.100 and 221.236.12.213 will be analyzed.
  The Advanced Filter tab is for you to create more complex filters with a wider range of filter parameters, including address, port, protocol, packet value, packet size and packet pattern. You need to select a logical rule for a single filter, the logical rules can be And, Or or Not. See "Advanced filters" for more descriptions.
• Add from filter table
  Click on the Add button and select From Filter Table... to open a dialog which lists all predefined filters, you can check one or more filters, before confirm your selection, you need to decide a filter rule: accept or reject the packets matching filter for analysis.
• Add by captured packet
  If you want to make a filter on the basis of a captured packet or item, just right click on the item and select Make Filter.... from the context menu, Javvin Packet Analyzer will fill in the filter automatically. This function is available for the Diagnoses - Events view, Endpoints view, Protocols view, Packets view, Connections view and Logs view.

New filters can be made at any time and will go into effect immediately.

Accepting or rejecting a filter

In Javvin Packet Analyzer you can accept some filters and at the same time reject some others. The packets matching to the accepted filter will be passed to analyzer and analyzed by Javvin Packet Analyzer, and in reverse if you set the filter as a rejected filter. To accept or reject a filter, you can:

• Decide filter rule when adding/editing filter
  
  

• Change filter status with the Add/Reject button
  
  

Saving, editing and removing a filter

• Saving a project filter
  When you finish the setting of a filter and confirm, Javvin Packet Analyzer will save the filter and list it in the Project Settings - Filter page. However, since the projects in Javvin Packet Analyzer are all independent, the filter settings of a project can not be shared by other projects unless you designate the filter setting as default. With the command Set as default Settings..., you can save a filter and its settings in the configuration category of system, each time when you open a new project, you can see the filter listed in the Project Settings - Filter page.
  Both simple filters and advanced filters can be set as default.
  

• Editing a filter
  To edit a filter, double click it from the filter list or use the Edit button. You can make modifications either in the capture process or when Javvin Packet Analyzer stands by, after confirmation the modifications will be go into effect instantly.
  Note: You are in danger of losing the specified parameters you have already entered as moving from the Advanced Filter page to the Simple Filter page, you have an opportunity to abort the operation when a warning appears.
• Removing a filter
  To delete a filter, make a selection from the filter list and click the Remove button. If you have set the filter as default, this operation will disable the previous setting.

Importing and exporting filters

• Import filters
  Javvin Packet Analyzer lets you import filters from the files in .cscflt format. Click the Import... button and select Import Filter from File..., Javvin Packet Analyzer will open the project file and list all available filter files, select one to open.
  
  
  
  If you decide to clear the current filter list when asked, only the filters imported will be showed; if you select No, the filters imported will be appended to the current filter list.
  
  
  
  
• Export filters
  To export filters, click the Export... button. When export filters, all the items in the filter list will be exported to a file in .cscflt format, which can be imported later by other projects.

Simple filters

The Simple Filter page allows you to customize some commonly used filters by address, port and/or protocol in a single filter. When multiple parameters are chosen they are connected by logical And statements. That is, packets must match all of the conditions in order to match the filter.

The simple filters defined can also be seen in the Advanced Filter page as below.

• Address filter
  You can set an address filter by physical address, IP address, IP range and IP subnet. To define an address filter, check the checkbox of Address filter first, select an address type from the upper combo box of Address1, then input an address into the lower combo box or select from the name table. Click the  icon to get references if you are not familiar with address formats.
  
  The combo box of Direction is for you to specify the send/receive relationship between the two addresses. You should select Both directions to match all packets going in either direction between address 1 and address 2, otherwise you could instead match only traffic going from address 1 to address 2, or match only traffic going the other direction.
  
  Similar as Address1, you must select an address type and enter a valid address in Address2 , or simply choose Any Address. You can select an address from the name table for both Address1 and Address2 by clicking the  icon. Below is an example of address filter.
  
  

• Port filter
  To define a port filter, check the Port filter checkbox, select a port type and input parameters with correct format in Port1. Notice that if you select Multiple ports, the ports you enter must be separated with semicolon. Other settings are similar as the Address filter section.
  
  Below is an example of port filter.
  
  
  
• Protocol filter
  To define a protocol filter, check the Protocol filter checkbox, click the Select button to open the Protocol Filter dialog, find protocols by the first alphabet of the protocol name, then select protocols by checking the corresponding check box and click OK to confirm your selection. The selected protocols are listed in the pane at the bottom of the Simple Filter page, you can delete a protocol item from the list with the Remove button.
  
  Below is an example of protocol filter.
  

Advanced filters

In addition to make simple filters by address, port and protocol, you can also choose packet size, packet value and packet pattern as filter parameters, which are available in the Advanced Filter page. Advanced filters are unique to Javvin Packet Analyzer enterprise edition.

To create an advanced filter, click the Filter icon  from the toolbar to open the Project Settings - Filter page. Click the Advanced Filter tab, you can see a screen with some icons and the text And, Or, Not representing the rules for settings advanced filters. The filter name, filter color and comment can be customized, if you check the check box of Set as default, this advanced filter will appear in the filter list each time when you open a new project.

You should specify a rule before adding a new filter item using logical And or logical Or statement; logical Not statement is for you to not accept the current filter item. The table below provides brief descriptions for these rules and other commands available in the Advanced Filter page.

You may define Address filters, Port filters and Protocol filters in either the Simple Filter page or the Advanced Filter page, but Packet Value filters, Packet Size filters and Packet Pattern filters can only be defined in the Advanced Filter page. It is allowed to switch between the Simple Filter page and the Advanced Filter page, however, you are in danger of losing the specified parameters you have already entered as moving from the Advanced Filter to the Simple Filter page, you have an opportunity to abort the operation when a warning appears.

Click the rule And or Or and select a filter item to define, the rule Not is disabled unless you choose an existing filter item first. The following are some setting examples.

• Packet Value filter
  
  

• Packet Size filter
  
  

• Packet Pattern filter
  You can set packet pattern filters by ASCII, HEX, UTF-8 or UTF-16.
  
  

Filter table

By clicking on the button  from the toolbar you can open the Filter Table which offers the most frequently used protocol filters predefined by system. This table lets you export, edit or delete the listed filter, you may also import filter from file or add a new filter. The change to this table is global.