3com WX1200 3CRWX120695A 用户手册
640
C
HAPTER
A: T
ROUBLESHOOTING
A
WX S
WITCH
src-mac {eq | neq | lt | gt} mac-addr
dest-mac {eq | neq | lt | gt} mac-addr
host-mac {eq | neq | lt | gt} mac-addr
mac-pair mac-addr1 mac-addr2
direction {eq | neq} {transmit | receive}
dest-mac {eq | neq | lt | gt} mac-addr
host-mac {eq | neq | lt | gt} mac-addr
mac-pair mac-addr1 mac-addr2
direction {eq | neq} {transmit | receive}
To match on packets to or from a specific MAC address, use the
dest-mac or src-mac option. To match on both send and receive traffic
for a host address, use the host-mac option. To match on a traffic flow
(source and destination MAC addresses), use the mac-pair option. This
option matches for either direction of a flow, and either MAC address can
be the source or destination address.
dest-mac or src-mac option. To match on both send and receive traffic
for a host address, use the host-mac option. To match on a traffic flow
(source and destination MAC addresses), use the mac-pair option. This
option matches for either direction of a flow, and either MAC address can
be the source or destination address.
If you omit a condition, all packets match that condition. For example, if
you omit frame-type, all frame types match the filter.
you omit frame-type, all frame types match the filter.
For most conditions, you can use eq (equal) to match only on traffic that
matches the condition value. Use neq (not equal) to match only on traffic
that is not equal to the condition value.
matches the condition value. Use neq (not equal) to match only on traffic
that is not equal to the condition value.
The
src-mac, dest-mac, and
host-mac conditions also
support lt (less than) and gt (greater than).
The observer ip-addr option specifies the IP address of the station where
the protocol analyzer is located. If you do not specify an observer, the
MAP radio still counts the packets that match the filter. (See “Displaying
Remote Traffic Monitoring Statistics” on page 643.)
the protocol analyzer is located. If you do not specify an observer, the
MAP radio still counts the packets that match the filter. (See “Displaying
Remote Traffic Monitoring Statistics” on page 643.)
The snap-length num option specifies the maximum number of bytes to
capture. If you do not specify a length, the entire packet is copied and
sent to the observer. 3Com recommends specifying a snap length of 100
bytes or less.
capture. If you do not specify a length, the entire packet is copied and
sent to the observer. 3Com recommends specifying a snap length of 100
bytes or less.
The following command configures a snoop filter named snoop1 that
matches on all traffic, and copies the traffic to the device that has IP
address 10.10.30.2:
matches on all traffic, and copies the traffic to the device that has IP
address 10.10.30.2:
WX1200# set snoop snoop1 observer 10.10.30.2 snap-length 100
The following command configures a snoop filter named snoop2 that
matches on all data traffic between the device with MAC address
aa:bb:cc:dd:ee:ff and the device with MAC address 11:22:33:44:55:66,
and copies the traffic to the device that has IP address 10.10.30.3:
matches on all data traffic between the device with MAC address
aa:bb:cc:dd:ee:ff and the device with MAC address 11:22:33:44:55:66,
and copies the traffic to the device that has IP address 10.10.30.3:
WX#1200 set snoop snoop2 frame-type eq data mac-pair
aa:bb:cc:dd:ee:ff 11:22:33:44:55:66 observer 10.10.30.3
snap-length 100
aa:bb:cc:dd:ee:ff 11:22:33:44:55:66 observer 10.10.30.3
snap-length 100