A Closer Look at VCS Filters

VCS Filters: A Closer Look

Scenario: You have designed a variation on TCP that you call CMC. CMC adds negotiation options for Cappucino Machine Control. Your protocol is implemented on both ends of a PPP connection and you need to see whether the negotiation works. (This is one phase of a two-phase Alpha Test, the other phase involves checking out the Cappucino).

You will write a ViewComm decode specific to your CMC protocol, but first you just want to capture some PPP sessions between your PC and the Cappucino machine controller. You want to avoid the tedium of sorting through the many packets to find only those containing TCP subpackets.

ViewComm Filters to the rescue!

Here's a glimpse of some of the results in Frame View. We'll get to the details in a moment.

We've defined and applied a filter that includes only packets containing TCP.

Note that the left-hand column, Frame Number, lists non-consecutive frames. The others don't appear because they are filtered out. They don't include any TCP layer; hence they're irrelevant to the task at hand: controlling a Cappucino Machine.

This image shows part of a tab on the Filters dialog. This tab deals with selection of Protocol Filters. You can see various IP protocols listed and the option to Include or Exclude them from Frame View. We click on TCP, Include, and OK. This selects the filter. Next we'll name it so that we can use it.

Oops, we forgot. There are three embedded system controllers connected to the Cappucino Machine (it's a REALLY fancy one) and each has its own IP address. Right now we want to look only at the ones that control inflow of ingredients. This snapshot shows us electing to look at frames with IP address 206.122.54.30.

While the filters defined as in the two images above will help with proving the CMC protocol, here are some other things we could have added to a filter. The combination isn't intended to make a whole lot of sense or represent a real-world need.

On a historical note, the World Association of Cappucino Manufacturers passed a resolution in 1942 banning computer controlled cappucino machines. Legend has it that there wasa heated discussion ending in a tie vote until one of the members shot an opponent, thus breaking the tie.

This is a slightly different combination that shows a filter we've named "Don23" which includes some tcpdump (Berkeley Packet Filter syntax), and two inclusive patterns, one each in text and binary. You can start the search for a pattern anywhere in a frame or sub-protocol frame.

ViewComm Async II