Logical AND, OR, and NOT operators in advanced filters
The Advanced view of the Edit Filter or Insert Filter dialog shows the parameters defined for the Advanced filter:
• A rectangular box represents each parameter (or filter node) that is added to the filter. If the Show details check box is selected, the details of the filter node are also displayed inside the box.
• Arrows indicate the flow of data through each filter node. A single arrow between filter nodes indicates an AND condition; any packets that match the filter node are allowed to pass through to the next stage. Multiple arrows between filter nodes indicate an OR condition (filter nodes stacked on top of each also indicates an OR condition); packets that match any of the filter nodes defined by the OR condition are allowed to pass through to the next stage.
• A red circle with an “X” inside a filter node indicates a NOT condition. All packets that do not match the filter node are allowed to pass through to the next stage.
• Right-click a filter node for the following options:
• And: Adds a new AND filter node to the currently selected node. Click the sub-menu arrow to the select the type of filter node.
• Or: Adds a new OR filter node to the currently selected node. Click the sub-menu arrow to the select the type of filter node.
• Not: Toggles the NOT condition of the currently selected node. A red circle with an “X” inside the filter node indicates a NOT condition. All packets that do not match the filter node are allowed to pass through to the next stage.
• Comment: Displays a dialog that allows you to add/edit a comment for the currently selected
• Swap And/Or: Toggles the currently selected node between an AND or OR filter node.
• Cut: Copies the currently selected node to the clipboard, and deletes the node.
• Copy: Copies the currently selected node to the clipboard.
• Copy Tree: Copies the currently selected node, and that node’s AND and OR nodes to the clipboard.
• Paste And: Pastes the nodes currently in the clipboard as an AND node to the currently selected node.
• Past Or: Pastes the nodes currently in the clipboard as an OR node to the currently selected node.
• Delete: Deletes the selected node.
• Right-click inside a blank area of the dialog for the following options:
• Show Details: Toggles displaying filter node details.
• Show Comment in Title: Toggles displaying comments added to filter nodes.
• Zoom In: Zooms in on the display.
• Zoom Out: Zooms out on the display.
• Zoom Reset: Resets the display.
TIP: You can also zoom in and out of the display by pressing the CTRL key while using your mouse’s scroll wheel.
An example of an Advanced filter is shown below:
The dialog displays a green icon representing a network adapter. Each parameter (or filter node) added to the filter is displayed showing the relationship between the network adapter and the capture buffer (represented by a computer icon).