how to check packet decoder network filter rule filter what amount of data

[Lalsingh]

HI,

I have make network filter rule in packet decoder and I want to know how much data is filter by this rule ?

Regards,

Lal pratap singh

[david_waugh]

Hi Lal

What you can do is make sure that your App Rule is set to Alert. This will then create meta in that meta key with the name of the app rule.

You can then use an investigation view to find out how much traffic the rule is hitting.

[JoshRandall]

Hi Lal,

Navigate to your Packet Decoder's Explore menu:

Expand the /decoder/stats node:

And look for the capture.netfilter.bytes stat:

This will be the total number of bytes that your network rules have filtered.

Similarly, the capture.appfilter.bytes stat here will show the total number of bytes that your App rules have filtered and truncated:

Hope this helps.