Wireshark · Ethereal-users: Re: [Ethereal-users] Display filter weirdness

[Ronnie Sellar <ronnie@xxxxxxxxxx>]

Mathew Butler wrote:
> Is there some kind of debugging output that I could send?

Not that would be any use to me, I'm not involved in Ethereal
development.  I was only asking about versions etc in case it triggered
a response from somewhere else.

> > ((ip.addr eq 192.168.0.11) and (ip.src ne 205.231.82.69 and ip.dst ne
> > 205.231.82.69) and (ip.src ne 205.231.82.42 and ip.dst ne 205.231.82.42))

> ip.addr eq herbie and (ip.src ne asimov and ip.dst ne asimov) and
> (ip.src ne stand and ip.dst ne stand)

One difference is that I haven't used brackets round the first 'eq'
statement.  This has just worked on our only machine running v0.8.19. 
Have you tried it ?  

Sorry I can't help much more than that.

Ronnie
-- 
Ronnie Sellar				Spider Software Limited 
Tel:  +44 131 475 7015			8 John's Place
Fax:  +44 131 475 7001			Edinburgh EH6 7EL
mailto:ronnie.sellar@xxxxxxxxxx		http://www.spider.com/