In this case, a filter on the user's IP or IPX network layer address would make sense, so that we can move the analyzer around and capture packets as they traverse routers. Remember, in a routed environment, only the network layer addresses stay consistent between end points. A router will place its own DLC address in the packet as it forwards it to the next router, or end-station. How we capture that protocol depends on how its encapsulated into the packet. For example, for IPX, there are four possible encapsulation types for Ethernet and two for token ring.
Most analyzers already have capture filter selections for different protocol types.
IPX NetBIOS is identified by a socket number, so we need to set a pattern match for that number. We have presented but a few of the capture filtering techniques to help narrow down your search. As you hone your skills in filtering and analysis by solving more and more problems, you will find yourself applying more complex filters for even quicker problem identification. In many cases, you can apply a complex filter that you developed as a display filter, to a capture filter. There will also be times, however, when you need to back off your capture filters to accept more packets, and then refine the filter.