Wireshark · Ethereal-dev: Re: [Fwd: Re: [Ethereal-dev] Filter expressions for exclusion]

[Guy Harris <gharris@xxxxxxxxx>]

On Tue, Dec 31, 2002 at 07:52:31AM -0700, John McDermott wrote:
> OK.  I have to agree here.  I think 'tcp.port==80' should mean "tcp
> packets with source or destination ports with a value of 80' (as it
> does), but by the "filters shouldn't do things I don't ask for" rule,
> "tcp.port != 80" should not imply tcp packets.

What you asked for was packets whose TCP port had a value other than 80.

Non-TCP packets have no TCP port, so they obviously don't have a TCP
port with a value other than 80.

> I'm sorry to disagree
> with Guy, but if a packet does not have a TCP port, its tcp.port value is
> not 80 (it is undefined) and therefore it should match the expression.

So for which comparison operators should an undefined value match and
for which comparison operators should an undefined value not match? 
(There are more comparison operators than "==" and "!=".)