ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Ethereal-dev: [Ethereal-dev] ANDing ip.addr no longer works?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Ian Schorr <spamcontrol2@xxxxxxxxxxx>
Date: Fri, 29 Aug 2003 17:18:31 -0400
Hi list,

I noticed that the latest CVS seems to have a quirk - ANDing ip.addr display filters works differently than it used to.

If I have packets from IP address 10.1.1.1 going to IP address 10.2.2.2, and I build a display filter of

	ip.addr == 10.1.1.1 && ip.addr == 10.2.2.2

results in no matched records.

Copying and pasting the same display filter back to a release 0.9.14 with the same capture file open works like I expect - all packets between the two hosts match the display filter.

Is this only me? I have noticed some odd quirks in the past when I build on OS X (which I'm doing now) versus using, say, the stock Windows builds (which I'm not doing in my example).

Ian