From: Scott Fringer [mailto:fringsm@xxxxxxxxxxxxxxxxx]
Sent: Tuesday, April 02, 2002 3:28 PM
> When I attempt to use a nondiscretionary port filter (tcp.port != xxx),
> it does not get applied. However, if I build the filter using both
> tcp.srcport != xxx and tcp.dstport != xxx it works fine.
> I noted the same behavior with ip.addr != xxx not filtering as expected
> but using ip.src != xxx and ip.dst != xxx works.
> Anyone else seeing this behavior?
Common mistake, both the source and destination ports are added
to the protocol tree as tcp.port, so tcp.port != xxx will be
true because it will match one of the ports. This assume the ports
aren't the same.
Try the filter -
!(tcp.port == xxx)
and you should get the results that you expect.
Jeff Foster
***
The information in this e-mail is confidential and intended solely for the
individual or entity to whom it is addressed. If you have received this
e-mail in error please notify the sender by return e-mail, delete this
e-mail, and refrain from any disclosure or action based on the information.
****
