Ethereal-dev: [Ethereal-dev] ip.addr != 1.2.3.4 should work as expected

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Ulf Lamping <ulf.lamping@xxxxxx>
Date: Mon, 09 May 2005 22:45:17 +0200
Hi!

Some filter strings like:

ip.addr != 1.2.3.4

doesn't work as expected (filter out packets to and from ip.addr
1.2.3.4), one must use:

!(ip.addr == 1.2.3.4)

instead (the same applies to tcp.port and alike "pseudo fields").

Strictly speaking this might be grammatically correct, but it seems that
this is a *very common* mistake, which should be avoided if possible IMHO.

Would it be possible to change the current display filter so it would
work as expected?

I don't know the grammatics behind this, so I don't know how much effort
this would be and I'm really not the person to change this (I personally
hate flex/yacc and alike :-)


So is there any reason that this shouldn't be changed, and maybe is
there someone able to change it?

Regards, ULFL