March 18, 2001
Finding CRC Errrors in a TCP Header
If you've ever used a Network Associate's Sniffer Pro to locate a CRC error in a TCP header, you've realized that there wasn't an obvious method to pull those frames out of a decode. There are no predefined filters in Sniffer Pro that will quickly group the TCP-based CRC errors, but there are search functions that can help you locate the frames.
Sniffer Pro includes a 'Find' function on the Display pull-down menu. To use the Find capability of Sniffer Pro, you must be displaying a decode in Sniffer Pro.
* To use the Find command, load your trace file and select the 'Decode' tab.
* From the 'Display' pull down menu, choose 'Find Frame'
* In the 'Find Frame' dialog box, select the 'Text' tab
* In the search field type "(should be". This is without the quotes, and it _is_ with the preceding open parenthesis - there are no close parenthesis. This is how it should look in the search field:
(should be
* Choose the radio button for 'Detail Text', and start searching!
We don't use the term 'should be' without the parenthesis because there are some decode strings that use that series of words to describe information. By using the open parenthesis, you are assured that the search will only stop on the text that describes the incorrect CRC.
This search capability can also be used for any text that Sniffer Pro might add to the decode's Detail screens. Search away!
Posted by james_messer at March 18, 2001 11:11 PM
Thanks for signing in, . Now you can comment. (sign out)
(If you haven't left a comment here before, you may need to be approved by the site owner before your comment will appear. Until then, it won't appear on the entry. Thanks for waiting.)