Sniffer使用教程.pptVIP

Note that switches and routers (unlike hubs) can block certain network traffic, affecting what the analyzer captures. You can also perform these functions by selecting Capture from the analyzer’s menu bar, or by using function key shortcuts: F10—Start/Stop capture F9—Stop and display capture F5—Display a stopped capture Note: The “Define a capture filter” icon is used on other Sniffer Portable screens as an “automatic” filter—a very quick method of display filtering, which you will use in the next section. Before starting a capture, you should configure the Expert options that determine how Expert data is processed and displayed. Expert options are described later in this section. Captured packets are stored in the capture buffer. You can display and analyze the packets currently in the capture buffer or save the packets to disk. Capture buffer options are tied to the Define Capture Filter Function. Set capture buffer options as shown above, or by selecting Capture Define Filter from the main menu, then selecting the Buffer tab. Capture Buffer Options Buffer Size—You can configure the size of the capture buffer from 256K bytes to 384 MB, depending on how much memory you have installed in your computer. (Note that if you set the buffer size larger than your computer’s RAM size, your computer will lock up.) Packet Size—You can save the entire packet in the capture buffer, or truncate each packet by setting the Packet Size option when defining a capture filter. By truncating large packets, you can save more packets in the capture buffer, thus extending the time covered by the capture and reducing the size of the capture data file, saving disk space (assuming you save the capture buffer to disk). On a very busy network, truncating frames may also help avoid losing frames, since longer frames take longer to store. When buffer is full—You can specify what to do when the capture buffer fills: Automatically stop the capture or let new data overwrite earlier data. N