1.3     Filter Configuration

The filter configuration of IP-Sniffer is done by means of a special configuration file. This file has to be formatted as the well-known Ini-File format, i.e.

 

[Section_1]

parameter_1 = value_1

parameter_2 = value_2

:

parameter_x = value_x

 

[Section_2]

:

 

[Section_x]

:

 

In following an example is shown:

[Log]
 LogPath=C:\Users\ipuser\ipsniff\Log
 LogLevel=3
 DiskSize=1000
 NoOfFiles=500
 OldestFile=500
 ZipArchive=1
 
 [General]
 NoOfFilters=2
 AdapterIp=192.168.0.2
 DumpFrame=1
 Logging=1
 
 [Filter_1]
 Protocol=3
 DestIp=192.168.0.48
 SrcIp=0.0.0.0
 DestPort=12345
 SrcPort=0
 IPC=1
 IpFrame=0
 
 [Filter_2]
 Protocol=2
 DestIp=192.168.0.2
 SrcIp=192.168.0.83
 DestPort=40001
 SrcPort=53201
 IPC=0
 IpFrame=1
 
 [Filter_3]
 :
 :
  

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 




 


 

All parameters are described in following:

 

[Log]

LogPath

path where the log-file shall be written
Note: the name of the log-file will be set automatically
<inst>_<yyyy>_<mm>_<dd>.log

LogLevel

log-level

1=error, 2=warning, 3=info, 4=debug

DiskSize

minimum of free disk space in MB

Note: the logging is stopped automatically if the value falls below this threshold

NoOfFiles

maximum number of files in the log-directory

Note: the oldest files are deleted automatically if value exceeds this threshold

OldestFile

oldest log-fil in days in the log-directory

Note: the file are deleted automatically if they exceeds this threshold

ZipArchive

older log-files are compressed automatically

0=off, 1=on

 

 

[General]

NoOfFilters

number of filter sections

AdapterIp

IP-address of the network adapter
Note: only necessary for Windows

DumpFrame

0 = dump only hex-data

1 = additionally dump data in well-formed output format

Logging

0 = logging off

1 = logging on

 


 

[Filter_X]

Protocol   

protocol filter

0 = all

1 = ICMP

2 = TCP

3 = UDP

DestIp   

destination IP-address filter

0.0.0.0 = no filter

SrcIp

source IP-address filter

0.0.0.0 = no filter

DestPort

destination port filter

0 = no filter

SrcPort

source port filter

0 = no filter

IPC

0 = IPC off

1 = IPC on

Note: the corresponding IPC-ID is generated automatically as following:

decontev_sniffer_ipc_<instance_no>_<filter_no>

e.g. decontev_sniffer_ipc_1_1

IpFrame

0 = send only payload data via IPC

1 = send entire IP-frame via IPC