Ethereal-users: Re: [Ethereal-users] Filters

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Mon, 09 May 2005 23:16:49 -0700
Ulf Lamping wrote:

Carl.Knox@xxxxxxxxxxxxxxx wrote:



Display filters, in particular "ip.addr != x.x.x.x", use to work for both
src and dst addresses, but now I must make an elaborate formula to filter
both src and dst.




This is a frequent mistake, use "!(ip.addr == x.x.x.x)", see
http://wiki.ethereal.com/DisplayFilters
...but it's not a case of "used to work"; this didn't change recently - "ip.addr != x.x.x.x" has, for a long time, meant "neither the source nor the destination address of the packet has the value x.x.x.x", so that it can match a packet whose source address is x.x.x.x as long as the destination address isn't x.x.x.x or whose destination address is x.x.x.x as long as the source address is x.x.x.x.
Perhaps he should indicate what "ip.addr != x.x.x.x" did when it worked, and what he has to do now?