Wireshark · Ethereal-users: Re: [Ethereal-users] Display Filter to Remove an IP Address

[Guy Harris <gharris@xxxxxxxxx>]

On Thu, May 20, 2004 at 01:47:22PM +0100, Keith French wrote:
> I am trying to construct a display filter to remove all traffic to and
> from a particular IP address, but all things I try do not work.  What I
> have tried is:-
> 
> not ip.addr eq 10.10.10.10
> not (ip.addr eq 10.10.10.10)
> !(ip.addr eq 10.10.10.10)
> ip.addr ne 10.10.10.10

That's odd, as "not (ip.addr eq XXX.XXX.XXX.XXX)" worked for me (it's
equivalent to "!(ip.addr eq XXX.XXX.XXX.XXX)").  I assume that "not
(ip.addr eq 10.10.10.10)" either caused packets to or from 10.10.10.10
to be displayed or caused packets neither to nor from 10.10.10.10 not to
be displayed - which of those, or both, is the case?