Observer Analyzer : Observer Analyzer : Decodes : Decoding network traffic : Opening files from unknown locations
Opening files from unknown locations
You may not know where or how a packet capture was taken. This can cause some confusion when decoding a foreign buffer file, because probe instance settings that may be unique to that probe instance may be saved in the buffer file. When opening a capture buffer, Observer uses the probe instance settings of the first probe instance in its list unless you specify which probe instance to use.
You may want to use this option if you are:
Unsure of the header, MPLS analysis, or ToS/QoS settings
Decrypting wireless data
Decoding protocols on non-standard ports (although user-defined protocols are not decoded for a NetFlow instance)
Note: This option is not intended to allow you to open a capture from a different topology. For instance, it will not make sense to use an Ethernet Probe instance to open a WAN capture or a Wireless probe instance to open a Fibre Channel capture.
Tip! Create a probe instance just for analyzing packet captures that you load into Observer . By using a dedicated probe instance, you can easily and temporarily change the probe instance settings. This allows you to view the buffer files using settings for the type of probe instance used to capture the file, and more importantly, you do not need to change any probe instance you use for monitoring.
Do the following:
1. Click the File tab, and click Options > Fallback Instance.
2. Select a probe instance with settings you think are similar to the capture adapter used to capture the buffer.