Wireshark-dev: Re: [Wireshark-dev] Re-use of header fields

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 09 Aug 2006 12:44:01 -0700

Benjamin M Stocks wrote:

Great! Thanks for the answer, as a follow up question: how does it work when I want to filter on a header field? Will it match ANY of the fields?

Yes. A filter "foo.bar == X", for example, matches all packets that have at least one instance of a "foo.bar" field with the value "X.

(This means, BTW, that the negation of "foo.bar == X" is *NOT* "foo.bar != X". "foo.bar != X" matches all packets that have at least one instance of a "foo.bar" field with a value other than X, but a packet could have one instance with the value "X" and another with the value "Y" and thus match *both* filters. The negation of "foo.bar == X" is "!(foo.bar == X)".)