Wireshark · Wireshark-dev: Re: [Wireshark-dev] ip.addr != 10.0.0.1

[Guy Harris <guy@xxxxxxxxxxxx>]

Ulf Lamping wrote:

> As I've written in my other mail, I would expect a dialog box in this 
> case, saying something like "ip.addr != 10.0.0.1 is very certainly not 
> what you want! Should I filter !(ip.addr == 10.0.0.1) instead, which 
> results in ...".

That applies to *any* field when you do a "!=" comparison; it's not 
unique to ip.addr (that's probably the most common example, but tcp.port 
and udp.port are probably also somewhat common places where this 
surprises users).  If we're to pop up a warning, I'd pop it up for any 
use of "!=", and offer a "don't show this dialog any more" checkbox so 
that the user can say "OK, I understand now" and not be bothered in the 
future.