It is possible to capture frames of a specific length using length filters.
Defining length filters
The following NTPL example filters frames with a length greater than or equal to 1,000
bytes.
Assign[StreamId=0] = Length >= 1000Frames with a length less than 100 are dropped using the following NTPL example.
Assign[StreamId=DROP] = Length < 100
A part of a frame can be specified using the Begin and
End parameters as shown in the following NTPL
example.
Assign[StreamId=1] = TunnelType==GTPv1-U AND \\ Length[Begin=InnerLayer4Payload; End=EndOfFrame]==(1000..1200)This defines a filter to capture all GTPv1-U frames with the layer 4 payload of length greater than or equal to 1,000 bytes, and less than or equal to 1,200 bytes. End=EndOfFrame in this example can be omitted as Begin=StartOFFrame and End=EndOfFrame are set by default, if not specified.
Note: End=EndOfFrame
includes the 4-byte FCS. The 4-byte FCS can be excluded using a static offset as
follows.
Assign[StreamId=1] = Length[Begin=InnerLayer4Payload; End=EndOfFrame[-4]]==1000Supported static offset values are -16384 to 16383.