Wireshark-dev: Re: [Wireshark-dev] ip.addr != 10.0.0.1
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Ulf Lamping <ulf.lamping@xxxxxx>
Date: Sun, 27 Jan 2008 16:50:15 +0100
Stig Bjørlykke schrieb:

Hi.

We often get questions why the filter "ip.addr != 10.0.0.1" does not
work as expected.

Is it a good idea to make some sort of special handling for filters
like "ip.addr", "tcp.port" and "udp.port" to expand to the commonly
expected behavior

Well, I don't know if a special filter handling is a good idea.


What was discussed some time ago was a warning if something like:

ip.addr !=

is used - as the result will most of the time not be what the user expected.
I've never took a deeper look into it, as I have very little experience with the filter engine. 

Regards, ULFL