Packet Logging into file

Packet Logging into file provides an easy technique to track packets matched at least one rule listed in the filter. To use this feature you should specify a Filename Template for logfiles. Every filter must have the unique Filename Template because it has own independent Packet Collector.

An example of the logfile is shown below. The lines beginning with '---' are a time when the Packet Collector was flushed. The first column is the protocol type. The 2nd and 3rd columns are the source IP address and the source port. The 4th and 5th columns are the destination IP address and the destination port. The 6th and 7th columns are the sent bytes counter and the received bytes counter.
 

 proto    src_ip     src_port    dst_ip        dst_port     sent       recv
  
--- Time: 2002-11-12 11:31:14
  TCP     192.168.3.1 client    64.12.174.121     80           0         80
  TCP     192.168.3.1 client    64.236.16.136     80         160         40
  TCP     192.168.3.1 client    207.46.249.27     80          40         81
  TCP     192.168.3.1 client    64.236.16.116     80          40          0
  TCP     192.168.3.1 client   207.200.91.184     80         160         80

--- Time: 2002-11-12 11:31:32
  TCP     192.168.3.1 client    64.236.16.136     80         432        256

--- Time: 2002-11-12 11:31:50
  TCP     192.168.3.1 client  205.188.238.185    443        1573      13652
  TCP     192.168.3.1 client    64.12.174.121     80         772        330
  TCP     192.168.3.1 client    207.46.249.27     80          40         41
  TCP     192.168.3.1 client  205.188.238.185     80         733        795

If "Log additional fields" option is enabled you can see an another picture below. The value in the brackets after 2nd and 4th column contains source and destination MAC address correspondingly. The latest column contains a value of TOS (Type of Service) field.
 

--- Time: 2002-11-12 11:41:35
  TCP     192.168.3.1 (5254ab2088ad) client   12.129.206.119 (008048c28d3d)     80       11629       8154   0
  TCP     192.168.3.1 (5254ab2088ad) client     193.45.10.72 (008048c28d3d)    443          80         80   0
  TCP     192.168.3.1 (5254ab2088ad) client   216.239.39.101 (008048c28d3d)     80         567          0   0
  TCP     192.168.3.1 (5254ab2088ad) client   216.239.39.101 (008048c28d3d)     80           0       1551   16
  TCP     192.168.3.1 (5254ab2088ad) client     216.26.160.8 (008048c28d3d)    110         383        494   0
  TCP     192.168.3.1 (5254ab2088ad) client   12.129.206.119 (008048c28d3d)    110         152        166   0

--- Time: 2002-11-12 11:41:53
  TCP     192.168.3.1 (5254ab2088ad) client   216.239.39.101 (008048c28d3d)     80          80          0   0
  TCP     192.168.3.1 (5254ab2088ad) client   216.239.39.101 (008048c28d3d)     80           0         40   16
  TCP     192.168.3.1 (5254ab2088ad) client   12.129.206.119 (008048c28d3d)    110         225        412   0

 Note
 
"client" in the third column means any dynamic port (1024-65535).