3Com WX4400 Command Reference Manual page 651

The MAP that is running a snoop filter forwards snooped packets
directly to the observer. This is a one-way communication, from the
MAP to the observer. If the observer is not present, the MAP still sends
the snoop packets, which use bandwidth. If the observer is present
but is not listening to TZSP traffic, the observer continuously sends
ICMP error indications back to the MAP. These ICMP messages can
affect network and MAP performance.
Examples — The following command configures a snoop filter named
snoop1 that matches on all traffic, and copies the traffic to the device
that has IP address 10.10.30.2:
WX1200# set snoop snoop1 observer 10.10.30.2 snap-length 100
The following command configures a snoop filter named snoop2 that
matches on all data traffic between the device with MAC address
aa:bb:cc:dd:ee:ff and the device with MAC address 11:22:33:44:55:66,
and copies the traffic to the device that has IP address 10.10.30.3:
WX1200# set snoop snoop2 frame-type eq data mac-pair
aa:bb:cc:dd:ee:ff 11:22:33:44:55:66 observer 10.10.30.3
snap-length 100
See Also
clear snoop on page 648
set snoop map on page 652
set snoop mode on page 653
display snoop info on page 654
display snoop stats on page 656
set snoop 651