Appendix C: Importing and Exporting Sniffer Filters

---

Sniffer maintains three filter files:

NXSAMPLE.CSF	The sample filter set (stored in the NAI\Sniffer\Program directory)
SNIFFER.CSF	The current filter set (stored in the NAI\SNIFFER\PROGRAM\LOCAL_x file)
SNIFFERDISPLAY.CSF	The display filter set (stored in the NAI\SNIFFER\PROGRAM\LOCAL_x file)

I rarely use or refer to the SNIFFERDISPLAY.CSF file because that only contains the Sniffer Display filters - as I mentioned earlier in this book, I think these filters are pretty lousy -- they can only be used to apply filters to captured data. Capture filters can be used on live traffic or on captured data.

This appendix details two tasks -- exporting a filter set and importing a filter set.

Important 

Always make a copy of your SNIFFER.CSF file.

Exporting a filter set is simple. Just copy your SNIFFER.CSF file and send it to someone else. Importing it is another story, however... you need to be very careful not to overwrite your SNIFFER.CSF file when you import a filter.

The SNIFFER.CSF file contains all the active capture filters that are on your Sniffer system.

When you are importing someone else’s filter, follow the steps listed below. BE VERY CAREFUL - again, don’t forget to make a copy of your SNIFFER.CSF file before import my filters.

Note 

These instructions work with Sniffer v4.5. If you have a later version of Sniffer, please check the Sniffer help files to see if there have been any changes to these step.

Step 1:	Close Sniffer.
Step 2:	Rename your NXSAMPLE.CSF file to NXSAMPLE-BACKUP.CSF.
Step 3:	If you bought the hardcopy of this book, go out to www.packet-level.com and download my sample filter set from the References section. The file is called LAURA[date].CSF where [date] indicates the date that I created the file. As I update this file, the [date] section may change. If you downloaded the softcopy of this file, you probably already noticed that my CSF file was included in the zipped up file.
Step 4:	Copy the LAURA[date].CSF file to your NAI\Sniffer\Program directory. Rename the file NXSAMPLE.CSF.
Step 5:	Launch Sniffer Pro.
Step 6:	Select Capture > Define Filter.
Step 7:	Click the Profiles button.
Step 8:	Click New.
Step 9:	Name your profile Night Crew Filter.
Step 10:	Click on the radio button for 'Copy Sample Profile.' You are now opening my sample filter set.

Step 11:

Locate and select the 'Night Crew Filter' profile. Click OK.

Now you've imported the filter you wanted. It's time to restore your standard Sample Filter file (NXSAMPLE.CSF).

Step 12:	Close Sniffer Pro.
Step 13:	Rename the current NXSAMPLE.CSF file on your system to LAURAS-NXSAMPLE.CSF.
Step 14:	Rename the NXSAMPLE-BACKUP.CSF file to NXSAMPLE.CSF.
Step 15:	Launch Sniffer Pro and check to see if the original default profile list appears now.

Voila! Pretty good, eh? Now, wouldn’t it be great to simply have an “export” and “import” button? Yipes! Keep this Appendix handy to refer to it after the fact.

---