6 USB Monitoring

The Beagle USB 480 Protocol Analyzer is capable of monitoring high-speed, full-speed, and low-speed USB devices in real time.

The Beagle USB 12 Protocol Analyzer is capable of monitoring full-Speed and low-Speed USB devices in real time.

The Data Center software is able to parse the USB packets and provides the user with several powerful tools for filtering the captured data.

6.1 Performing a USB Capture

Here are the steps for starting a capture with the Beagle USB 480 analyzer or the Beagle USB 12 analyzer.

1. Start the Data Center application.

2. Connect the Beagle USB analyzer to the analysis computer. Make sure that the green indicator LED has illuminated. Be sure the analyzer is powered before plugging in any devices on the capture side to ensure the target device can function properly.

3. Click the Connect to Analyzer… button in the toolbar and connect to the analyzer.

4. Ensure the Protocol Lens is set to USB.

5. Connect the Beagle USB analyzer to the target host computer. This can be the same computer. Make sure that the amber indicator LED has illuminated.

6. Click the Run Capture button to start the data capture. Once the capture has started, the capture indicator will turn green and an informational transaction will appear in the Transaction window which notes when the capture was started.

7. Connect the target device.

   With the Beagle USB 480 analyzer, any high-speed, full-speed, or low-speed USB device can be connected directly.

   With the Beagle USB 12 analyzer, full-speed and low-speed devices can be connected directly to the Beagle USB 12 analyzer. High-speed devices can also be monitored, but they must be connected through an in-line full-speed hub.

8. To stop the capture, click on the Stop Capture button.

The Bus pane will only display a device’s descriptors if the device’s entire enumeration sequence was captured. If the target device connects to the host before the capture is started, the device enumeration will not be captured and the descriptors cannot be displayed.

6.2 Beagle USB 480 Device Settings

There are several USB capture settings that can be set by the user when using a Beagle USB 480 Protocol Analyzer. Please note that there are no user controlled device settings when using the Data Center application with the Beagle USB 12 Protocol Analyzer. The device settings in this section only apply when using the Beagle USB 480 Protocol Analyzer.

The USB device settings can be changed in the Device Settings dialog (Figure 34). To open this dialog, click on the Device Settings… button or go to Analyzer | Device Settings….

Omit Packets Matching Beagle Analyzer’s Device Address

When the analysis port of the Beagle USB 480 analyzer is connected to the same USB host controller as the traffic being monitored, the Beagle analyzer may observe its own USB traffic. This is because all downstream packets from the host are broadcast to all USB links. Therefore, packets from the host to the Beagle analyzer may appear on the capture side of the Beagle USB 480 analyzer.

One method to avoid flooding the capture with traffic for the Beagle analyzer is to enable the Omit packets matching Beagle’s device address option. This option instructs the Beagle USB 480 analyzer to discard any packets directed to its own device address. Further information about this option may be found in Device Operation section of the Beagle datasheet.

Do not enable this option if the Beagle USB 480 analyzer is not on the same host controller or if it is not on the same computer as the traffic being monitored. This may cause the Beagle analyzer to discard USB packets intended for another device since device addresses across different USB buses can overlap. Furthermore, do this only if you are monitoring a High-speed device with the Beagle 480 Analyzer, as High-speed devices and Full-speed or Low-speed devices on the same host may also have overlapping addresses.

Bus Speed

The Beagle USB 480 analyzer has the ability to automatically detect the speed at which the USB-under-test is operating. However, there may be a situation where the user wishes to explicitly lock it to a specific USB bus speed. This control allows the user to switch between the Beagle analyzer automatically detecting the bus speed to locking the hardware to a specific speed.

If the user knows that the traffic on a bus will always be a certain speed, there can be at least one minor advantage to locking the target speed in the capture settings. Specifically for low-speed and full-speed devices, by locking the bus speed, the Beagle analyzer will not attempt to detect high-speed signaling levels. This will help mitigate the appearance of Chirp J/K and Tiny J/K events which are not of great importance for low-speed- and full-speed-only devices, and these events would otherwise only serve to clutter the display.

Capture Mode

The Beagle USB 480 analyzer has two modes of operation during capture.

• Real-time – The capture is streamed from the Beagle USB 480 analyzer to the Data Center software as it is received. If the hardware is monitoring traffic faster than it can stream data to the analysis PC, it will cache the data in the analyzer’s hardware buffer. If the hardware buffer should fill completely, the capture will be stopped.

• Delayed-download – The Beagle analyzer hardware will not stream the capture data to the analysis PC until the capture is concluded. The capture will be stored in the analyzer’s hardware buffer until it is filled or the user stops the capture to download the results. This feature is useful if the Beagle analyzer is connected to the same host controller as the traffic being monitored, as this greatly reduces the amount of USB traffic generated by the Beagle analyzer while the capture is taking place. More information about the utility of a delayed-download capture can be found in the Beagle datasheet (Device Operation section). More details on running a delayed-download capture can be found in Section 6.3.

Hardware Input Filter

These options will enable the Beagle USB 480 analyzer hardware to discard some common packet groups to reduce the amount of capture data received. Some of these packet groups correspond to polling operations and so these sequences do not contain any actual data transfer.

Note: If there is a change in the digital input lines in the middle of one of the packet groups that is being filtered, that group will not be discarded. In this way, the context for the digital input line change is preserved.

The hardware filter options are:

• SOF – Discard Start-of-Frame packets.

• IN – Discard IN+ACK and IN+NAK packet groups.

• PING – Discard PING+NAK packet groups.

• PRE – Discard all PRE tokens.

• SPLIT – Enabling this option will cause the hardware to discard many polling split packet groups. The split groups that will be discarded are:

  • SSPLIT+IN

  • SSPLIT+IN+ACK

  • CSPLIT+IN+NAK

  • CSPLIT+IN+NYET

  • CSPLIT+OUT+NYET

  • CSPLIT+SETUP+NYET

Digital Inputs

This option enables the user to individually enable the four digital input lines on the Beagle USB 480 analyzer hardware. During the capture, if there is a change on one of the enabled input lines, an event transaction will be displayed in the Transaction window with the new input line state.

Digital Output

The Configure Digital Outputs… button opens the digital output settings dialog (Figure 35) to configure the digital output lines on the Beagle USB 480 analyzer hardware. See the Device Operation section of the Beagle analyzer datasheet for information on the timing of the digital output pins.

The following sections describe the tabs of the digital output settings dialog.

Pin 1

When enabled, digital output pin 1 (Figure 35) will switch to its active state at the beginning of capture and will stay at the active level until the capture is stopped. The options available on this tab are to set pin 1 to be active high, active low, or to disable the pin.

Pin 2

When enabled, digital output pin 2 (Figure 36) will switch to its active state whenever there is a USB packet being transmitted on the bus. The options available on this tab are to set pin 2 to be active high, active low, or to disable the pin.

Pin 3

Digital output pin 3 (Figure 37) can be set to match a PID, a device address, and an endpoint address. For example, pin 3 can go active when it observes a DATA0 packet to any device but 0x01 on any endpoint address. Each of the match settings can be set to match if the packet equals the parameter (=), does not equal the parameter (!=), or it can disregard the parameter (X). Pin 3 can also be set to be active high, active low, or to be disabled.

Pin 4

Digital output pin 4 (Figure 38) can be set to match a PID, a device address, an endpoint address, and a data payload pattern. As with Pin 3, the PID, device, and endpoint settings can be set to match if the packet equals the parameter (=), does not equal the parameter (!=), or it can disregard the parameter (X). The data pattern to match can be set in the Data Matching Options once data matching is enabled. Pin 4 can also be set to be active high, active low, or to be disabled.

Data Matching Options

Clicking the Data Match Options button in the Pin 4 tab of the Digital Output Settings dialog will reveal the data match options (Figure 39). Checking the Enable Data Matching option will enable the data match functionality.

Note: PID matching will be disabled when data pattern matching is enabled. The data PIDs selected in the PIDs to match section will be used instead.

The data match pattern for output pin 4 can be specified in the hex editor. XX can be used anywhere in the pattern as a wildcard to match any 1-byte datum at that location. The data match pattern can be up to 1024 bytes in length.

When data pattern matching is enabled, every data packet with the specified PID will have its data payload (not including the PID or the CRC field) matched against as much of the pattern as the data payload size. So a data packet with an 8-byte data payload will be compared against the first 8 bytes of the data match pattern. And a data packet with a 64-byte payload will be compared against the first 64 bytes of the data pattern.

Using the pulldown box above the hex editor, the packet can be set to match if the payload equals the pattern (=) or does not equal (!=) the pattern.

The Write CSV button allows the contents of the data match hex editor to be written to a comma-separated values (*.csv) file. The CSV file can be loaded into the data match table by clicking the Read CSV button. The Clear Data button will clear the contents of the data match table.

6.3 Delayed-Download Capture

In this capture mode, the capture data is not streamed out of the analysis port of the Beagle analyzer until after the analyzer has stopped monitoring the bus. This greatly reduces the amount of USB traffic going to the Beagle USB 480 analyzer while the capture is active, and thus is primarily useful when the Beagle analyzer and the test device share the same host controller. Please refer to the Device Operation section of the Beagle datasheet for more information regarding the delayed-download mode of the Beagle analyzer.

Performing a Delayed-Download Capture

To run a delayed-download capture, select the Delayed-Download Capture Mode option in the Device Settings dialog. During the delayed-download capture, there will still be a small amount of Beagle USB 480 analyzer traffic on the capture bus since the software pings the analyzer to retrieve capture statistics. Therefore, if the monitored device is High-speed and shares its host controller with the Beagle Analyzer, it is advisable to enable the Omit packets matching Beagle’s device address option to filter out the few Beagle packets that will remain during the delayed-download capture. In addition, because the capture will be stored in the Beagle analyzer’s hardware buffer during the capture, enabling the Hardware input filter options may be useful to allow for a longer capture by preventing non-essential traffic from being saved in the hardware buffer.

Once the capture settings have been set, click the Run Capture button to open the Delayed-Download Capture dialog (Figure 40).

Set the polling interval for the capture. When polling during the capture, the Data Center software will check the hardware buffer usage and display it in the progress bar. The polling will generate traffic on the bus, so polling can be disabled to eliminate this traffic by choosing Never for the polling interval.

Click the Start Capture button to start the capture. If polling is enabled, the progress bar will show the portion of the hardware buffer that has been filled with capture data. The progress bar will be updated every time the Data Center software polls the Beagle USB 480 analyzer. When the hardware buffer is full, the capture will stop and the dialog will say that it is ready to download the capture from the hardware.

If polling is disabled, the only way to know that the hardware buffer has filled and capture has stopped is by observing that the red activity LED on the Beagle Analyzer is no longer blinking and has turned off.

You may click the Download Capture button at any point to download the results. This will stop the capture if it had not already stopped. Once the download begins, the Delayed-Download Capture dialog will automatically close.

The Cancel button may be clicked at any time to exit the delayed-download process and close the dialog. This will completely discard any data that has been captured.

6.4 Transaction Window

The Transaction window (Figure 41) displays all the transactions as they were captured on the USB bus in real time.

For a general description of the Transaction window, see Section 5.1. The following describes the specifics of the USB Transaction window.

Speed (Sp)
The bus speed of the transaction (Beagle USB 480 analyzer only). The background color of the column will also indicate the bus speed. The possible values displayed are shown in Table 5.

Length (Len)
The length of the transaction in bytes is shown if the transaction has a byte value. If the transaction doesn’t have a byte value, such as bus events, the duration is shown instead.

Error codes (Err)
Error codes listing abnormal conditions that occurred while capturing the transaction. See Table 1 for the possible error codes. In addition, there are several USB specific error codes as described in Table 6.

Dev
The device being addressed represented as a decimal value.

Ep
The endpoint being addressed represented as a decimal value.

Data
For individual packets, the Data column will show the raw data bytes including the PID and CRC. For some transactions, such as SETUP transactions, the Data column may show a parsed representation of its corresponding packet data. For other transactions, such as IN transactions, the Data column will show its internal packet data without any PID or CRC.

Transaction Groups

USB packets are grouped into transactions when they are detected on the USB bus. The four transaction groups are IN, OUT, SETUP, and LPM. Each transaction group is denoted with a unique icon and can be expanded to reveal the individual packets. The timestamp of the group will match the timestamp of the first item in the group to appear on the bus.

Polling transactions that do not have a data payload, such as IN/NAK or PING/NAK, will also be included in the related transaction group. Figure 42 shows an example of this where the IN/NAKs associated with the IN transaction have been included in the IN group.

As a result of grouping the polling transactions into higher level transaction groups, there may be situations where packets are shown out of chronological order. Figure 43 shows an example of this. The collapsed PING/NAK group at index 5604 has an earlier timestamp than the collapsed SOF group at index 5602. Digital input transactions may also appear out of order since they are not included in any transaction group.

Consecutive isochronous, or interrupt, transactions that are related may be grouped together as shown in Figure 44.

Special Transaction Types

Besides the four main transaction groups, there are several different types of transactions which can appear in the Transaction window.

Information

Start/Stop informational transactions indicate when a capture was started or stopped. These transactions appear in blue text.

Events

Event transactions represent non-packet bus activity, such as host connect, target device connect, bus reset, or bus speed events. These transactions are displayed as a text description of the event that occurred with further information available in the Info pane. These transactions appear in the Transaction window in green text. Please refer to the Device Operation section of the Beagle datasheet for more information on specifics of bus events and their timings.

The types of event transactions are:

• Host connected – USB cable connected to upstream port.

• Host disconnected – USB cable disconnected from upstream port or voltage level dropped below detection threshold.

• Target connected – USB cable connected to downstream port.

• Target disconnected – USB cable disconnected from downstream port or voltage level dropped below detection threshold.

• Reset – Bus put into reset state.

• Sync error – Bad sync observed on packet. (Beagle USB 12 only)

• Low-speed – The bus is operating at low-speed. (Beagle USB 480 analyzer only)

• Full-speed – The bus is operating at full-speed. (Beagle USB 480 analyzer only)

• High-speed – The bus is operating at high-speed. (Beagle USB 480 analyzer only)

• Suspend – The bus has entered suspend state. (Beagle USB 480 analyzer only)

• Resume – The bus has left suspend state. (Beagle USB 480 analyzer only)

• Keep-alive – Low-speed keep-alive strobe detected. This signal is used by the host to keep low-speed devices from going into suspend mode. (Beagle USB 480 analyzer only)

• Chirp J – A high-speed chirp J was observed. This signal is part of the High-speed Detection Handshake used by high-speed devices to transition from full-speed to high-speed. (Beagle USB 480 analyzer only)

• Chirp K – A high-speed chirp K was observed. This signal is part of the High-speed Detection Handshake used by high-speed devices to transition from full-speed to high-speed. (Beagle USB 480 analyzer only)

• Tiny J – A false J caused by a voltage divider effect between the device pulling up the D+ line with a 1.5K resistor and the host not driving the data line to ground with a sufficiently low enough output resistance. (Beagle USB 480 analyzer only)

• Tiny K – A false K caused by a voltage divider effect between the device pulling up the D- line with a 1.5K resistor and the host not driving the data line to ground with a sufficiently low enough output resistance. (Beagle USB 480 analyzer only)

• Input line change – Voltage change on one or more of the input lines detected. (Beagle USB 480 analyzer only)

• OTG HNP – An On-The-Go Host Negotiation Protocol was detected. (Beagle USB 480 analyzer only)

• OTG SRP data-line pulse – A data-line pulse of the On-The-Go Session Request Protocol was detected. (Beagle USB 480 analyzer only)

• OTG SRP Vbus pulse – A Vbus pulse of the On-The-Go Session Request Protocol was detected. (Beagle USB 480 analyzer only)

Collapsed

There are common packet sequences that are repeated frequently on the USB bus which can quickly fill up a capture and make it difficult to find the data of interest. In order to reduce this problem, the Data Center software will automatically “collapse” these sequence of packets into a single row. Packets will only be collapsed together if they share the same device and endpoint. Some of these collapsed transactions may appear in transaction groups.

These collapsed packets will collapse the following types of data.

SOF

Start-of-Frame. These packets are issued once every millisecond in full-speed and every 125 microseconds in high-speed to keep devices synchronized with the host.

Keep-alive

Low-speed keep-alive strobe. This signal is used by the host to keep low-speed devices from going into suspend mode. (Beagle USB 480 analyzer only)

IN/NAK

Some USB devices require the host to periodically poll the device to see if any changes occurred. The host will issue an IN packet and if the device has no changes, it will send a NAK. This sequence of packets can quickly eat up capture space when a device is idle and is therefore collapsed.

IN/ACK

When an IN/DATA/ACK occurs on a parallel USB link, only the IN and the ACK will be observed by the Beagle analyzer. Therefore, this packet group is collapsed.

PRE/IN, PRE/IN/NAK, PRE/IN/PRE/ACK

When a host communicates to a low-speed device through a full-speed hub, the host must send the hub a PRE packet before every packet to the low-speed device. This alerts the hub that the packet that follows the PRE will be transmitted at the low-speed data rate. This is called low-speed over full-speed.

These packet groups are similar to IN/NAK and IN/ACK, so are similarly collapsed.

PING/NAK

PING packets are used in high-speed traffic to poll if a device is ready to receive data. The NAK packet indicates that the device is not yet ready to receive more data.

SPLIT transactions

Split transactions are used by the host to communicate with a full- or low-speed device through a high-speed hub. (Beagle USB 480 analyzer only)

In a typical situation, the host will send a START-SPLIT packet (SSPLIT) to the hub. The split packet will contain flags indicating which port to send the following packets to and what speed to send them at. Then the host will send the token packet (IN, OUT, or SETUP) to send to the full- or low-speed device. For OUT and SETUP transactions, a data packet will follow. Then the hub may or may not send an ACK to the host, depending on the transfer type.

The hub will then transmit the packets to the downstream device at the requested bus speed. The host will then periodically poll the hub to see if the hub has completed the transaction and to get the response of the device. The host does this by sending the hub a complete-split (CSPLIT) packet followed by the same token packet it sent earlier. The hub will then either respond with a NYET to indicate that it is not yet done sending the transaction, or it will respond with the device’s response (data or NAK for IN tokens, a handshake packet for OUT and SETUP tokens).

Since there can be a good deal of polling with split transactions, including using IN packets to poll the downstream device, the following packet groups are collapsed into SPLIT groups:

• SSPLIT/IN will be shown as [ START ]

• SSPLIT/IN/ACK will be shown as [ START ]

• CSPLIT/IN/NYET will be shown as [ NYET ]

• CSPLIT/IN/NAK will be shown as [ NAK ]

The following packets groups are collapsed inline with their associated transaction group:

• CSPLIT/OUT/NYET

• CSPLIT/SETUP/NYET

6.5 Class-Level Parsing

Some USB hosts and devices may communicate with one another using device classes. The Data Center software supports parsing of these device classes. Further information about device classes may be found in the USB Background section of the Beagle datasheet.

General Use

Class-level parsing may be either enabled or disabled by clicking the classification button in the Transaction Window Controls section of the application. For class-level parsing to work correctly, it is necessary for the Data Center software to capture the enumeration of the USB device. The easiest way to ensure that the enumeration is captured is to first start the capture and then to plug in the device into the analyzer. It is not possible to enable or disable classification while the capture is running. The enumeration is preserved across capture sessions. This may lead to unintended behavior if different devices share the same device address across the capture sessions.

Note that when using circular buffer or saving a filtered view the class-level parsing ability may be lost. For more information please see the section on circular buffer (section 4.13) and saving a capture (section 20).

Also, note that the Beagle USB 12 Analyzer supports parsing of the Standard Device Requests only. Class specific parsing is not supported with the Beagle USB 12 Analyzer.

Class-Level Transactions

The benefit of enabling classification is that class-level fields are visible for each transfer. One or more protocol-level transactions will be grouped into a class-level transaction. Additionally, for some classes, a class-level transaction may contain one or more other class-level transactions. The transaction will display information that is relevant to the device class. For instance, with a mass storage device, a class-level transaction may be named “Read”, and the Data column will show the logical block address and length of the transfer. Additional information can be obtained by clicking on the class-level transaction and looking at the Info pane. The Info pane will show the parsed fields of the selected class transaction. See Figure 45 for an example.

Control Transfers

An additional benefit of enabling classification is that the protocol-level transactions that make up a control transfer are grouped into a single class-level transaction (Figure 46). If the control transfer can be parsed, the transaction will be named accordingly. Otherwise, the transaction will show up as “Control Transfer.”

6.6 Bus Pane

The USB Bus pane (Figure 47) provides detailed information about each device on the bus. Clicking on a packet in the Transaction window will highlight the related device in the Bus pane.

The Bus pane will only display descriptor information for devices whose enumeration was captured. It is possible to have missing or incomplete descriptor information if a capture is stopped prematurely or is interrupted.

Descriptor information is stored in a cache for an entire capture session. The descriptor information associated to a device is based on the device’s address. Therefore all packets that are sent or received to the same address are considered to be interacting with the same device.

However, if the USB control message “SET ADDRESS” is seen, the software will parse all new descriptor information as corresponding to a different target device, even if that device has the same USB address as a previously connected target device.

Please note that this feature can cause some strange behaviors. When appending to an older capture file, different devices may share the same address. The Data Center software may become confused and display the wrong descriptor information if a SET ADDRESS is not seen.

Based on how the operating system assigns device addresses, there may be duplicate addresses for different devices when devices are disconnected and plugged in.

Clicking on a device will show a summary of the descriptor information below the tree. Expanding a device will reveal a hierarchy of descriptor information from the device, configuration, interface, and endpoint descriptors. Clicking on any level of the tree will show a parsed view of those descriptors and any child descriptors.

The packets and bytes columns list the number of each that have been sent or received from each endpoint, interface, configuration, and entire device. The byte count includes only the size of the data payload, excluding PIDs, CRCs, etc.

Right clicking in the Bus tree will reveal a popup menu that gives the user the option to apply a filter so that specific devices can be shown or hidden in the Transaction window.

Details Window

Refer to section 5.2 for an overview of the Details View. Note that for USB captures, a bit-level timing view of the data is not available.

6.7 Filtering a USB Capture

A USB capture can be filtered in real time or after it has been completed. The Data Center software offers an extensive list of filters (Figure 48) to help developers filter out extraneous data. All filters are non-destructive and users are free to apply filters multiple times without losing data.

For a description of the General filters and how filtering works, refer to Section 5.5.

Bus Filters

Devices

An integer value, or list of values, that filters transactions based on their device address. This filter only applies to transactions that have a device address. Addresses should be expressed as decimal values as they are shown in the Dev column. Multiple addresses can be listed separated by commas or spaces.

Endpoints

An integer value, or list of values, that filters transactions based on their endpoint address. This filter only applies to transactions that have an endpoint address. Addresses should be expressed as decimal values as they are shown in the Ep column. Multiple addresses can be listed separated by commas or spaces.

Reset/Suspend/Connect Events

Unchecking this option will hide all bus events.

Chirps

Unchecking this option will hide all chirp J and chirp K events.

SOFs/Keep-Alives

Unchecking this option will hide all SOF and keep-alive events.

Collapsed

Unchecking this option will hide all collapsed transactions. Note that this setting will not affect collapsed SOFs and keep-alives, as they are bus events and not transactions.

Digital Inputs

Unchecking this option will hide all digital input events.

Protocol Filters

The Protocol filters are broken into three types: class filtering, transaction filtering, and packet filtering.

Class

When Class is selected, the Device Requests and the Class Transfers options apply only to class-level transactions, not to the protocol-level transactions or the packets inside the class-level transactions.

The Device Requests options filter class-level transactions on the Default Control Pipe based on the bmRequestType field of the transfer. For example, unchecking the Host-To-Device option would hide all the Set device requests such as the Set Configuration request.

The Class Transfer option decides whether to show all of the class transactions which are not on the Default Control Pipe. For example, unchecking this option will hide all of the class transactions that occur on endpoints other than 0.

When all of the options under the Device Requests and the Class Transfers are selected, all transactions packets are matched. None of the protocol-level transactions, or individual packets will match unless all of the options under the Device Requests and the Class Transfers are selected.

Transactions

When Transactions is selected, the Token and Handshake options apply only to the protocol-level transactions as a whole, and not to the class-level transactions, or the individual packets inside the transactions.

Any protocol-level transaction that has BOTH a selected Token and a selected Handshake will match. None of the individual packets will match, unless all the Token and Handshake options are selected.

For example, selecting only IN, SETUP, ACK and NAK will show all IN/ACK, IN/NAK, SETUP/ACK and SETUP/NAK transactions. All other transaction groups will not be shown.

The Token and Handshake options are also applied to collapsed transactions. For example, unchecking the NAK handshake will hide all IN/NAK collapsed transactions.

Packets

When Packets is selected, only the selected packets match, and all of the class-level transactions and the protocol-level transactions do not match. This means that even with all the individual packet options checked, every transaction will appear in the Transaction window as a soft match. This is helpful for isolating specific packet types apart from transactions when used in conjunction with the Show parent if child matches option (Section 5.5).