Wireshark · Ethereal-users: Re: [Ethereal-users] Display filter weirdness

[Ronnie Sellar <ronnie@xxxxxxxxxx>]

Mathew Butler wrote:
> ((ip.addr eq 192.168.0.11) and (ip.addr ne 205.231.82.69 and ip.addr ne
> 205.231.82.42)) was my first attempt.  It did not do what I wanted it to --

Agreed, just putting 'ip.addr ne X' doesn't work.

> ((ip.addr eq 192.168.0.11) and (ip.src ne 205.231.82.69 and ip.dst ne
> 205.231.82.69) and (ip.src ne 205.231.82.42 and ip.dst ne 205.231.82.42))

This works for me.  Which version of Ethereal are you running (I'm on v
0.8.18) ?
I was also using 'hostname' rather than xxx.xxx.xxx.xxx style.

ip.addr eq herbie and (ip.src ne asimov and ip.dst ne asimov) and
(ip.src ne stand and ip.dst ne stand)

Showed me everything from herbie that was not to or from asimov or
stand.
-- 
Ronnie Sellar				Spider Software Limited 
Tel:  +44 131 475 7015			8 John's Place
Fax:  +44 131 475 7001			Edinburgh EH6 7EL
mailto:ronnie.sellar@xxxxxxxxxx		http://www.spider.com/