This approach has been used extensively with our OmniPeek Network Analyzer. You can apply them to some degree to other analyzers as well.
Set a station address filter to select the conversation between two data link addresses.
Remember, LLC operates on one single data link only. The LLC level of conversation ends at a router (since the router re-transmits a new frame on its 'other side'; when it forwards a frame at Layer 3).
Set a protocol filter to select ONLY the LLC layer
You can now follow the flow of the Type 2 conversation
Alternatively you may set the filter to select one data link address and any other data link address to view all conversations associated with the first station.
For the latest information on our products and services please go to our new site at www.savvius.com.
We are in the process of migrating some of our legacy content to our new site, so Wildpackets.com is still available. If the content you are looking for has already been migrated we will automatically redirect you.