Wireshark · Ethereal-users: RE: [Ethereal-users] Display filter weirdness

["Mathew Butler" <winged@xxxxxxxxxxxxxxxxxxx>]

Version of Ethereal: 0.8.19.

I did also try the hostname syntax, and it still didn't work.

I'll see if I can send a screenshot -- the capture file has sensitive data
in it, else I'd send it.

Is there some kind of debugging output that I could send?

-Mat Butler

-----Original Message-----
From: ronnie@xxxxxxxxxx [mailto:ronnie@xxxxxxxxxx]
Sent: Wednesday, October 03, 2001 12:34 AM
To: Mathew Butler; Ethereal Users
Subject: Re: [Ethereal-users] Display filter weirdness


Mathew Butler wrote:
> ((ip.addr eq 192.168.0.11) and (ip.addr ne 205.231.82.69 and ip.addr ne
> 205.231.82.42)) was my first attempt.  It did not do what I wanted it
to --

Agreed, just putting 'ip.addr ne X' doesn't work.

> ((ip.addr eq 192.168.0.11) and (ip.src ne 205.231.82.69 and ip.dst ne
> 205.231.82.69) and (ip.src ne 205.231.82.42 and ip.dst ne 205.231.82.42))

This works for me.  Which version of Ethereal are you running (I'm on v
0.8.18) ?
I was also using 'hostname' rather than xxx.xxx.xxx.xxx style.

ip.addr eq herbie and (ip.src ne asimov and ip.dst ne asimov) and
(ip.src ne stand and ip.dst ne stand)

Showed me everything from herbie that was not to or from asimov or
stand.
--
Ronnie Sellar				Spider Software Limited
Tel:  +44 131 475 7015			8 John's Place
Fax:  +44 131 475 7001			Edinburgh EH6 7EL
mailto:ronnie.sellar@xxxxxxxxxx		http://www.spider.com/