CACE Pilot: Views and Capture Filters
Joke Snelders reporting from the field

August 2010

About The Author
My name is Joke (pronounced \yo-k\ or Joan for those who do not speak Dutch). During the day, I work as a secretary for a non-profit organization providing assisted living for mentally handicapped people in the south of The Netherlands. In my spare time I like to use Wireshark. I find it interesting and necessary to monitor my home network to see what is going on. As a user I like to answer questions at the Wireshark Mailing List. What is in it for me? Well, I learn a great deal whenever I try to solve real-world problems. I am also a member of the NGN (the Dutch Network Users Group). I write articles about how to use Wireshark and the command line tools. And if there is still some spare time left, I like to go biking in the woods near my hometown with my husband and fellow geek.

Introduction

CACE Pilot, a network visualization and analysis tool from CACE Technologies, is fully integrated with Wireshark. Here you can read more about the latest release: version 2.3. In this article I will show how to organize Views and how to add capture filters to Views.
CACE Pilot is shipped with approximately 200 Views. The Views consist of a collection of interactive display components like bar charts, strip charts, conversation rings, grids and so on. After loading a capture file you can apply one or more Views. You can also use traffic from a live source: a wired ethernet adapter or a wireless adapter. You can copy the Views, which you always want to use, to a custom folder. When you want to analyze a capture file, you just have to drag and drop the custom folder on the capture file and all the Views in the folder are applied at once. It is even more handy to create several custom folders for different companies, locations, networks and so on. Copy the Views, you need to those folders. Next you can also set capture or display filters to those Views. These filters are saved in the Views. And again; you can apply them all at once by dragging and dropping the whole folder on a capture device or a capture file. It is also a good idea to create folders to monitor your wired and wireless home network.Want to see how this works? Continue reading to see how to manage the folders and how to add capture filters.

About CACE Pilot

CACE Pilot is a visually rich and powerful analyzer for wired and wireless networks that revolutionizes the use of Wireshark by providing capabilities not found in the worlds most popular packet and network analysis tool. Fully integrated with Wireshark, CACE Pilot capitalizes on users existing expertise while dramatically increasing efficiency in identifying and diagnosing network problems.

1 of 3

Feature Overview

Create Custom Folders

1. Right-click on: Custom 2. Select: Create Subfolder 3. Scroll down and look for the Views you want to copy to the folders you have just created. 4. Select the View. 5. Use the CTRL-key to select multiple Views. 6. Right-click and select the appropriate folder.
Add a capture filter to a View
1. Right-click the View, you want to apply the filter to. 2. Select: User Filter 3. Select: Set Choose one of the filters or create you own filter by hitting Add. 1. Choose a name 2. Select Wireshark Capture Filter (BPF) 3. Add filter string You can find more nformation about capture filter in the Wireshark Users Guide, the Wireshark Wiki or my previous articles about capture filter samples. When you are done, drag and drop the folder to the capture device or the capture file. Note The filters symbols show which Views contain filters. You can also see the filter syntax on the left side. Get a full-featured 10-day free trial of CACE Pilot.

2 of 3

About CACE Technologies, Inc.
CACE Technologies Inc. is the sponsor and innovative force behind Wireshark and WinPcap, the worlds most widely used Open Source network traffic capture and analysis tools. The company develops cutting-edge network analysis and troubleshooting products that complement Wiresharks prodigious packet inspection capabilities. The CACE Shark Distributed Monitoring System provides enterprise-class, end-to-end network monitoring and analytics capabilities and extends the Wireshark experience into distributed network environments. Known for its user-friendly modular products, the company offers the most cost-effective analysis solutions for modern enterprise networks.
CACE Technologies 1949 5th Street, Suite 103 Davis, CA 95616 tel: 530.758.2790 fax: 530.758.2781 www.cacetech.com

All trademarks, registered trademarks, service marks or registered service marks are the property of their respective owner/s. 2010 CACE Technologies, Inc. All rights reserved.

3 of 3

Public Relations Contact Janice Spampinato CACE Technologies th Street, Suite 103 Davis, CA 95616 530.758.2790 x111 mail to: janice.spampinato@cacetech.com FOR IMMEDIATE RELEASE
CACE Technologies Upgrades CACE Pilot
Version 2.2 adds Windows 7 Compatibility and new TCP and VoIP Views to the Network Analysis, Visualization, and Reporting Tool that Fully Integrates with Wireshark
Davis, California, January 19, 2010 CACE Technologies, Inc., sponsor of the Wireshark project and a leading innovator in network analysis, today announces the release of CACE Pilot v2.2, adding Windows 7 compatibility and several new customer-requested Views to its powerful network analyzer that provides large data file manipulation, traffic visualization, reporting capabilities, and many other features to enhance the Wireshark user experience. Besides accommodating Windows 7 (32 and 64 bit) users, CACE Pilot v2.2 delivers new Views that are among the most requested from product adopters. Pilot Views are the core analysis and visualization feature of the application. Pilot contains a collection of several hundred Views, including a comprehensive collection for 802.11 that can be applied directly to wireless sources such as CACE Technologies industry standard AirPcap adapters. The new Views, which expand the product coverage for 802.11, TCP, and VoIP, are:

o o o o o

802.11 Roaming Time Analysis: Use this View in conjunction with two AirPcap adapters to detect roaming delays that could disrupt VoIP or media protocols in wireless networks FCS Errors Over Time: Identify high levels of frame corruption in wireless networks TCP Window Size Over Time: Analyze the progress of the TCP window for a specific conversation or for the whole network Min and Max TCP Round Trip Time Over Time: Highlight worst and best TCP round trip time values to quickly identify network delays TCP Round Trip Time - 1ms Update Interval: Spot micro-variation of the network latency that could normally go undetected VoIP SEER Over Time: Gain visibility on the responsiveness of the phone SIP system as experienced by the users
Loris Degioanni, CACE Technologies Co-Founder, CTO and Chief Pilot Engineer, states, This new version of CACE Pilot addresses the obvious requirement to support a major new Windows operating system release, but also demonstrates our responsiveness to customer requests to broaden the scope of our tool and accommodate real-world analysis scenarios. We intentionally crafted CACE Pilot to allow for the easy addition of new Views, and to readily provide extended capabilities to the tool. Our customers seem to really appreciate this level of support, which is included as part of their annual update subscription plan.
About CACE Pilot CACE Pilot is a visually rich and powerful analyzer for wired and wireless networks that revolutionizes the use of Wireshark by providing capabilities not found in the worlds most popular packet and network analysis tool. Fully integrated with Wireshark, CACE Pilot capitalizes on the user's existing expertise while dramatically increasing efficiency in identifying and diagnosing network problems. With CACE Pilot, you can: Quickly open and analyze multi-gigabyte trace files Easily isolate traffic of interest through an extensive collection of network analysis metrics called Views Visualize long-duration live and off-line traffic capture statistics by moving back in time through large data sets with just a few mouse clicks Baseline and monitor network traffic with a flexible trigger-alerting mechanism called Watches Create professional reports directly from your customized Views Take advantage of Wiresharks capture and display filters and prodigious dissector library for deep packet analysis
Wireshark Within The ability to perform advanced filtering operations is the key to effective network analysis. The integration of CACE Pilot with Wireshark is designed to optimize use of Wiresharks extensive collection of capture and display filters. The use of Wireshark filters in conjunction with CACE Pilot Views leads to virtually limitless analysis and visualization possibilities. CACE Pilot Video Collection A collection of videos reviewing the Pilot interface and navigation, drill-down techniques, the Time Control feature, Watches, and more, is available at www.cacetech.com/products/pilot.htm. CACE Pilot Pricing A single-seat license for Pilot, which includes a 12-month update subscription, is $1,295 USD and can be purchased through our on-line catalog at www.cacetech.com/products/catalog or through one of our reseller partners. For enhanced wireless troubleshooting, Pilot is sold in combination with AirPcap Ex and Nx adapters. About CACE Technologies, Inc. CACE Technologies is a creative group of product designers and engineers specializing in networking solutions designed to enhance the Wireshark user experience. Experts in Windows device driver and network monitoring tools development, CACE' core engineering team includes the creators of Wireshark and WinPcap, premier open-source tools for protocol analysis and packet capture.

Trademarks property of their respective holders