Defining Display Filters; Capture Filters - HP Cisco MDS 9216 - Fabric Switch Configuration Manual

Chapter 68 Troubleshooting Your Fabric
S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m
•
•

Defining Display Filters

Display filters limit the frames that can be displayed, but not what is captured (similar to any view
command). The filters to be displayed can be defined in multiple ways in the GUI application:
•
•
•
•
•
Regardless of the definition, each filter must be saved and identified with a name.
Note This GUI-assisted feature is part of Ethereal and you can obtain more information from
http://www.ethereal.com.

Capture Filters

You can limit what frames are captured by using the capture filters feature in a remote capture. This
feature limits the frames that are captured and sent from the remote switch to the host. For example, you
can capture only class F frames. Capture filters are useful in restricting the amount of bandwidth
consumed by the remote capture.
Unlike display filters, capture filters restrict a capture to the specified frames. No other frames are visible
until you specify a completely new capture.
The syntax for capture filter is different from the syntax for display filters. Capture filters use the
Berkeley Packet Filter (BPF) library that is used in conjunction with the libpcap freeware. The list of all
valid Fibre Channel capture filter fields are provided later in this section.
Procedures to configure capture filters are already documented in the Ethereal website
(http://www.ethereal.com). Some examples of how you can use this feature as follows:
•
•
•
•
OL-8007-10, Cisco MDS SAN-OS Release 3.x
To view all FLOGI frames in VSAN 1, use this expression:
fcels.opcode == FLOGI && mdshdr.vsan == 2
To view all name server frames, use this expression:
dNS
Auto-definition
Manual definition
Assisted manual definition
Only manual definition in local capture
No assists
To capture frames only on a specified VSAN, use this expression:
vsan = 1
To capture only class F frames, use this expression:
class_f
To capture only class Fibre Channel ELS frames, use this expression:
els
To capture only name server frames, use this expression:
dns
Cisco MDS 9000 Family Fabric Manager Configuration Guide
Configuring a Fabric Analyzer
68-21