Filter Selector

The filter function helps to reduce the monitored Ethernet traffic from different links or ports. This makes monitoring simpler and users can focus only on the traffic of interest.

Multiple output filter selector This example shows the basic function of the filter selector. The selection per port is fully independent from the other outputs and the user can select the same traffic as often as needed. The selection is also working on the 10G output and does not interfere with the live traffic by any means. The selector delay is less than 1ms, so there is no impact on the measurement at all.

Individual filters (up to 50) per port

positive filter / negative filter / negative input filter / Fingerprint filter
 
The Fingerprint Filter is a  unique feature to filter in  payload, this is necesary to reduce the load on the
monitoring. See example

What can be selected?

 
The user can select IP traffic by IP address and port number in a very smart way.

E.g. the user wants to monitor the traffic between the hosts
10.10.10.9 - 10.10.10.14  and  20.20.20.9  20.20.20.14

Without smart selection the user had to setup 72 different filters.

10.10.10.9 - 20.20.20.9   and opposite direction 20.20.20.9 - 10.10.10.9
10.10.10.9 - 20.20.20.10 and opposite direction 20.20.20.10 - 10.10.10.9
         UNTIL
10.10.10.14 - 20.20.20.14 and opposite direction 20.20.20.14 - 10.10.10.14

With smart selection only

 10.10.10.10/29 in address field one and
 20.20.20.20/29 on address filed two

need to be entered. Because the CUBRO Packetmaster does not differentiate between destination and source  - it filters always the full conversation. This is also done on port numbers – e.g.  if all http traffic should be filtered the selected port number is set to 80 and that´s it.