Ethereal-dev: Re: [Ethereal-dev] ip.addr != 1.2.3.4 should work as expected

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "John McDermott" <jjm@xxxxxxxxxx>
Date: Mon, 09 May 2005 15:34:33 -0600
On Mon, 9 May 2005 16:19:42 -0500, Gilbert Ramirez <gilbertr@xxxxxxxxx> wrote: 


So, maybe we need a different "==". One that means "there exists an x
that is equal to y", and one that means "all x's equal y". Trying to
borrow from logic, we could use "A" and "E":

A(ip.addr) == 1.2.3.4
E(ip.addr) == 1.2.3.4
The problem is that we should never see packets which match the latter: it is really only useful for !=; likewise one is (as Ulf pointed out) unlikely to mean the former.
Part of the problem is that "ip.addr == X" really means "ip.src == X or ip.dst == X". I have never written !(ip.addr == 1.2.3.4) but find myself writing ip.src != 1.2.3.4 && ip.dst != 1.2.3.4, probably because I think of it that way.
Maybe the fields like .port and .addr that are really sort of macros need to look different. I dunno about A and E, though. 

--john
--
John McDermott, CCP
Writer, Educator, Consultant
jjm@xxxxxxxxxx        www.jkintl.com
V: +1 505/377-6293  F: +1 505/377-6313