Configuring Display Filter Settings

This section describes how to configure Packet Monitor display filter settings. The values that you provide here are compared to corresponding fields in the captured packets, and only those packets that match are displayed. These settings apply only to the display of captured packets on the management interface and do not affect packet mirroring.

* 
NOTE: If a field is left blank, no filtering is done on that field. Packets are displayed without regard to the value contained in that field of their headers.
To configure Packet Monitor display filter settings:
1
Navigate to the Dashboard > Packet Monitor page.
2
Click Configure. The Packet Monitor Configuration dialog displays.
3
Click the Display Filter tab.

* 
NOTE: In the following options, you can specify negative values by prefixing the value with an exclamation point (!).
•
In the Interface Name(s) field, type the name of the SonicWall appliance interface(s) for which to display packets.You can specify up to ten interfaces separated by commas. Interface names should be the same as those displayed on the Network > Interfaces page; for example:
•
For NSA series: X0. X1, X2:V100.
•
For TZ series or SOHO: wlan, wwan, modem, opt, wan, lan.

You can use a negative value to configure all interfaces except the one(s) specified; for example: !X0, or !LAN.

4
In the Ether Type(s) field, enter the Ethernet type(s) for which you want to display packets.You can specify up to ten Ethernet types separated by commas. Currently, the following Ethernet types are supported:
•
ARP
•
IP
•
IPv6
•
PPPoE-SES
•
PPPoE-DIS

The latter two can be specified as just PPPoE.

This option is not case-sensitive. For example, to capture all supported types, you could enter: ARP, IP, IPv6, PPPOE.

You can use one or more negative values to capture all Ethernet types except those specified; for example: !ARP, !PPPoE.

You can also use hexadecimal values to represent the Ethernet types, or mix hex values with the standard representations; for example: ARP, 0x800, IP. Normally, you would only use hex values for Ethernet types that are not supported by acronym in SonicOS. See Supported Packet Types.

5
In the IP Type(s) field, enter the IP packet types for which you want to display packets. To display all IP types, leave this field blank.

You can specify up to ten IP types separated by commas. The following IP types are supported:

•
TCP (default)
•
UDP
•
ICMP
•
ICMPV6
•
GRE
•
IGMP
•
AH
•
ESP
•
6TO4

This option is not case-sensitive.

You can use one or more negative values to capture all IP types except those specified; for example: !TCP, !UDP.

You can also use hexadecimal values to represent the IP types, or mix hex values with the standard representations; for example: TCP, 0x1, 0x6. See Supported Packet Types.

6
In the Source IP Address(es) field, type the IP addresses from which you want to display packets. You can specify up to ten IP addresses separated by commas; for example: 10.1.1.1, 192.2.2.2, 2001::1, 2002::1. You can use one or more negative values to capture packets from all but the specified addresses; for example: !10.3.3.3, !10.4.4.4, !2001::1.
7
In the Source Port(s) field, type the port numbers from which you want to display packets. You can specify up to ten TCP and/or UDP port numbers separated by commas; for example: 20,21,22,25. You can use one or more negative values to capture packets from all but the specified ports; for example: !80,!8080.
8
In the Destination IP Address(es) field, type the IP addresses for which you want to display packets. You can specify up to ten IP addresses separated by commas; for example: 10.1.1.1, 192.2.2.2, 2001::1, 2002::1. You can use one or more negative values to capture packets destined for all but the specified addresses; for example: !10.3.3.3, !10.4.4.4, !2001::1.
9
In the Destination Port(s) field, type the port numbers for which you want to display packets. You can specify up to ten TCP and/or UDP port numbers separated by commas; for example: 20, 21, 22, 25. You can use one or more negative values to capture packets destined for all but the specified ports; for example: !80, !8080. Default ports are 25,10025.
10
To match the values in the source and destination fields against either the source or destination information in each captured packet, select the Enable Bidirectional Address and Port Matching check box. This option is selected by default.
11
To display captured packets that the SonicWall appliance forwarded, select the Forwarded check box. This option is selected by default.
12
To display captured packets that the SonicWall appliance generated, select the Generated check box. This option is selected by default.
13
To display captured packets that the SonicWall appliance consumed, select the Consumed check box. This option is selected by default.
14
To display captured packets that the SonicWall appliance dropped, select the Dropped check box. This option is selected by default.
15
To save your settings and exit the configuration window, click OK.