Wireshark · Ethereal-dev: Re: [Ethereal-dev] Filter expressions for exclusion

["J.Smith" <lbalbalba@xxxxxxxxxxx>]

>
> Would there be any loss in generality of filters if there wasn't an
implicit
> 'and protocol' term?
>

Well as far as I know, the filter expression parsing is in exactly the same
style as tcpdump uses. (Someone please correct me here if im wrong on this).
Changing this is ethereal would probably be confusing for the people that
are accustomed to using tcpdump style filter expressions, so in that respect
your modification might not be such a good idea.

>
> The issue I am raising is that the default behaviour is
> non-intuitive and I would guess that it has been the cause of
> head-scratching for most Ethereal users.
>

Maybe it would help if there would be a section in the online help or/and
the manual that explicitly stated this behaviour, and warns users that such
an expression might not be what the user intended ?


Anyways,

Just my 2$



Sincerely,
J.Smith