|
This tab allows you to set rules for capturing packets. If one or
more rules are set, the program filters packets based on these
rules and displays only the packets that comply with the rules.
Note that CommView is not a firewall, and when you set rules,
packets are still processed by the operating system; they are not
just displayed and logged by CommView. If a rule is set, the name
of the corresponding tab is displayed in bold font.
You can save your rules configuration(s) to a file and load them by
using the
Rules
command of the program's menu.
Since LAN traffic can often generate a high number of packets, it
is recommended that you use rules to filter out unnecessary
packets. This can considerably reduce the amount of system
resources consumed by the program. If you want to enable/disable a
rule, select the appropriate branch on the left side of the window
(e.g.
IP Addresses
or
Ports),
and check or uncheck the box describing the rule
(Enable
IP Address rules
or
Enable port rules).
There are eight types of rules that can be used:
Protocols & Direction
Allows you to ignore or capture packets based on Ethernet (Layer 2)
and IP (Layer 3) protocols, as well as on packet direction.
This example shows how to make the program capture only inbound and
outbound ICMP and UDP packets. All other packets in the IP family
will be ignored; all pass-through packets will be ignored
also.
MAC Addresses
Allows you to ignore or capture packets based on MAC (hardware)
addresses. Enter a MAC address in the
Add Record
frame, select the direction (From,
To,
or
Both),
and click
Add MAC Address.
The new rule will be displayed. Now you can select the action to be
taken when a new packet is processed: the packet can be either
captured or ignored. You can also click on the MAC Aliases button
to get the list of aliases; double-click on the alias you would
like to add, and the corresponding MAC address will appear in the
input box.
This example shows how to make the program ignore packets that come
from 0A:DE:34:0F:23:3E. All packets that come from other MAC
addresses will be captured.
IP Addresses
Allows you to ignore or capture packets based on IP addresses.
Enter an IP or IPv6 address in the
Add Record
frame, select the direction (From,
To,
or
Both),
and click
Add IP Address.
You can use wildcards to specify blocks of IP addresses. The new
rule will be displayed. Now you can select the action to be taken
when a new packet is processed: the packet can be either captured
or ignored. You can also click on the IP Aliases button to access
the list of aliases; double-click on the alias you would like to
add, and the corresponding IP address will appear in the input
box.
This example shows how to make the program capture the packets that
go to 63.34.55.66, go to and come from 207.25.16.11 and come from
all addresses between 194.154.0.0 and 194.154.255.255. All packets
that come from other addresses or go to other addresses will be
ignored. Since IP addresses are used in the IP protocol, such
configuration will automatically make the program ignore all non-IP
packets.
Usage of IPv6 addresses requires Windows XP or higher and that the
IPv6 stack be installed.
Ports
Allows you to ignore or capture packets based on ports. Enter a
port number in the
Add Record
frame, select the direction (From,
To,
or
Both),
and click
Add Port.
The new rule will be displayed. Now you can select the action to be
taken when a new packet is processed: the packet can be either
captured or ignored. You can also click on the
Port Reference
button to get a list of all known ports; double-click on the port
you would like to add and its number will appear in the input box.
Ports can also be entered as text; for example, you can type
in
http
or
pop3,
and the program will convert the port name to the numeric
value.
This example shows how to make the program ignore packets that come
from port 80 and go to and come from port 137. This rule will
prevent CommView from displaying inbound HTTP traffic, as well as
inbound and outbound NetBIOS Name Service traffic. All packets
coming to and from other ports will be captured.
TCP Flags
Allows you to ignore or capture packets based on TCP flags. Check a
flag or a combination of flags in the
Add Record
frame, and click
Add Flags.
The new rule will be displayed. Now you can select the action to be
taken when a new packet with the entered
TCP flags is processed:
the packet can be either captured or ignored.
This example shows how to make the program ignore TCP packets with
the PSH ACK flag. All packets with other TCP flags will be
captured.
Text
Allows you to capture packets that contain certain text. Enter a
text string in the
Add Record
frame and click
Add Text.
The new rule will be displayed. Now you can select the action to be
taken when a new packet is processed: the packet can be either
captured or ignored.
This example shows how to make the program capture only the packets
that contain "GET". Check the
Case sensitive
box if you want the rules to be case sensitive. Check the
UTF8
or
UTF16
box if you want the rule to match the text encoded using the
respective encodings. All other packets that do not contain the
text mentioned above will be ignored. If you would like to create a
rule based on hex byte sequences, when the text is not printable
(e.g. 0x010203), use the
Advanced
Rules.
Process
Allows you to capture packets based on the process name. Enter a
process name in the
Add Record
frame and click
Add Process Name.
The new rule will be displayed. Now you can select the action to be
taken when a new packet is processed: the packet can be either
captured or ignored. You can enter partial process names,
e.g.
netscp
or
net;
any process name that contains such a substring will match the
rule. Process names are not case-sensitive.
This example shows how to make the program capture only the packets
that were sent or received by
netscp.exe.
Packets sent by other processes will be ignored.
Advanced
Advanced rules are the most powerful and flexible rules that allow
you to create complex filters using Boolean logic. For the detailed
help on using advanced rules, please refer to the Advanced
Rules chapter.
|
