Sniffr使用教程.ppt

If Windows on your Sniffer Portable has been configured to participate in the network with the card you have chosen, your other network traffic will be mingled in with the traffic on the network. This could be NetWare traffic, browser activity, etc. Set up a “This Station” filter to eliminate your traffic when you don’t want to see it in your traces. It is always helpful to use descriptive names for the local agents such as Ethernet Segment One. Some names could be describing a subnet, the adapter card, protocols, or corporate division names. The slide shows one adapter with two different local agents. For each adapter card you would have at least one local agent. Local agents have a name and an associated directory. The first local agent name and directory is called LOCAL by default. The agent directories are maintained under: C:\Program Files\NAI\Sniffer\Program (Windows 98) C:\Program Files\NAI\SnifferNT\Program (Windows NT and 2000) You can edit the first name but the first directory is always called LOCAL. When the next local agent is created, its associated directory will be named LOCAL_2. Then another local agent is created, and its directory is LOCAL_3, etc. The local agent settings include the address book, capture filter settings, packet display options, update frequency, and alarm thresholds. You can copy these settings to a new local agent so if there are some generic filters that you want all local agents to have, just create them once in the original local agent and copy them when you create the new local agent. If you do not use the “Copy settings from” field, the new local agent will be created using the settings currently active on Sniffer Portable. You can then change these settings to suit your needs. You can use the Log Off/Log On option to specify whether a selected interface card should be started in “log on” (actively monitoring and ready to start capturing data) or “log off” mode. Most of the items in the menu bar will be used in this