Time to 'Select'

Jim Thor � WildPackets Professional Services

This month I'm going to address the need of being able to actively select certain packets from an active capture. This occurs when you have an active capture running, which you cannot stop for whatever reason, but you wish to apply a filter to it. Unfortunately, if you apply a filter, what you�re capturing changes, which you do not want to do (again for whatever reason).

Potential Options

You do have the option of creating a second capture and applying the filter, but that means that you:

Have enough system resources available, and
Knew you wanted to do this prior to capturing the packets you want to see.

You also have the option to use �Select Related�, but its capabilities are limited to certain options, and in this case, you want to be very specific about the packets that you want to see.

Solution: �Select��

You will find �Select�� in the �Edit� menu, or you can use the hot key combination of �Ctrl-E�. Both options will bring up the �Select� dialog.

This option is similar to �Select Related�, with one major difference; you can use any filter to Select on. With the �Select� option, you can now �Select� any packet(s) by any criteria, even down to a specific bit. And you can do it at any time you want, even during a live capture.