Kaspersky Anti Targeted Attack Platform

Filtering links by communication protocol

To filter links on the network interactions map by protocol:

1. In the toolbar above the network interactions map, open the Protocols drop-down list.

   This opens a window with a table of protocols displayed as a protocol stack tree. You can control the display of tree nodes using the + and - buttons next to the names of protocols that encompass protocols of the next tiers.

   The table columns contain the following information:

   • Protocol is the name of the protocol in the protocol stack tree.
   • EtherType is the number of the next-layer protocol encapsulated by the Ethernet protocol (if the protocol has a specified number). Displayed in decimal format.
   • IP number is the number of the next-layer protocol encapsulated by the IP protocol (if the protocol has a specified number). Specified only for protocols that are part of the IP protocol structure. Displayed in decimal format.
2. If necessary, use the search bar above the table to find the protocols that you need.
3. In the list of protocols, select check boxes for protocols that you want to use in search conditions.

   If you select or clear the check box for a protocol that contains nested protocols, check boxes are also automatically selected or cleared for all nested protocols.

4. Click OK.

Only links that used the selected protocols are displayed on the network interactions map.