Wireshark · Ethereal-dev: [Ethereal-dev] Filter expressions for exclusion

[Chris Waters <chris.waters@xxxxxxxxxxxxxxxxxxxx>]

Hi,

It seems to me that one aspect of Ethereal filtering is non-intuitive, and
also unnecessary. Consider the following filter:

tcp.port != 10

At first glance it appears that the purpose of the filter is to exclude all
packets where the TCP port is 10. However this expression will also exclude
all non-TCP packets, which was probably not the intent of the person that
wrote the filter.

In any filter referring to a field 'protocol.field' it appears that their is
an implicit 'and protocol' added to the expression. This is very confusing.
Is it necessary, or desirable?

Regards,

Chris.

chris.waters@xxxxxxxxxxxxxxxxxxxx
www.networkchemistry.com