Filter-based local retransmission
It is possible to locally retransmit frames on multiple ports while delivering the same frames to the host as illustrated in the figure.
This NTPL example configures filters to retransmit SMTP traffic on one port, HTTP traffic
on another and the rest of the traffic on a third port, while everything is captured and
delivered to stream
0.
Define SrcPort = \\
Macro("Data[ProtOffset=Layer4Header[0];DataType=ByteStr2;DataMask=[15:0]]")
Define TcpPort_HTTP = Macro("80")
Define TcpPort_SMTP = Macro("25")
Assign[StreamId=0] = Port==0 # Capture all
Assign[Priority=0; DestinationPort=1] = (SrcPort==TcpPort_SMTP AND Port==0 AND \\
Truncated==False)
Assign[Priority=0; DestinationPort=2] = (SrcPort==TcpPort_HTTP AND Port==0 AND \\
Truncated==False)
Assign[Priority=10;DestinationPort=3] = Port==0 # The remaining traffic