Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] display filter on a field that appears more than once in a m

From: Andrew Schweitzer <a.schweitzer.grps@xxxxxxxxx>
Date: Wed, 06 Sep 2006 21:02:38 -0400
ronnie sahlberg wrote:
The difference is the difference between the upside down A (==For ALL it is true)
and the mirrored E (==there EXISTS at least one)

I.e. payload.packet.a_field != 1
is only the same as
!(payload.packet.a_field == 1)

if this field exists exactly once in the set.

If the field exists multiple times   then
payload.packet.a_field != 1
is no longer the same as
!(payload.packet.a_field == 1)


try rewriting your filters to be
!(payload.packet.a_field==1)
instead


Awesome, it worked, thanks.