By using AND to filter on these operations, you can look for packets that have both the type 3 value and the code 3 value at the correct offset. For example, you may want to capture FTP traffic that is used to put files onto local systems, to retrieve files from local systems, or to view file lists. Understanding how FTP works will help you create a fil-ter that captures specific FTP traffic. FTP uses a series of commands directly after the TCP header. Figure 6 shows how you specify patterns for this filter in Sniffer Pro 4.5, and Figure 7 shows the final data pattern filter.
Fragmented packets cause additional overhead and inefficient use of the network bandwidth.
In some cases, hackers can use fragmented packets to cross a firewall with data that should be filtered from the network. Figure 8 shows the format of an IP header. As you can see, creating a filter to capture this fragment requires some extra thinking. Figure 9 shows characteristics of the various packets seen on a network. You can use Sniffer Pro 4.5's binary format to make your filter a bit more clear instead of jumping to hex translations.