Wireshark · Ethereal-dev: Re: [Ethereal-dev] ip.addr != display filter does not work withbcasts/mcasts?

Ethereal-dev: Re: [Ethereal-dev] ip.addr != display filter does not work withbcasts/mcasts?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Martin Regner" <martin.regner@xxxxxxxxx>

Date: Sun, 5 Sep 2004 11:24:47 +0200

Yaniv Kaul wrote:
> When trying to run:
> ip.addr != 1.2.3.4
> It didn't filter the packets:
> 1.2.3.4 -> 1.2.3.255
> 1.2.3.4 -> 224.2.223.232
> 
> Is that ok/known?

There are two ip.addr fields in the ip-header.

Read chapter 6.3.4  "A common mistake" in the Ethereal User guide

http://www.ethereal.com/docs/user-guide/ChWorkBuildDisplayFilterSection.html

The filter "! (ip.addr == 1.2.3.4)" is maybe want you should use
or "ip and !(ip.addr == 1.2.3.4)" (if you only want ip-packets).

Another alternative is to use "(ip.src != 1.2.3.4) and (ip.dst != 1.2.3.4)"

Follow-Ups:
- Re: [Ethereal-dev] ip.addr != display filter does not work withbcasts/mcasts?
  - From: Alok

References:
- [Ethereal-dev] ip.addr != display filter does not work with bcasts/mcasts?
  - From: Yaniv Kaul

Prev by Date: [Ethereal-dev] Bug report: crash in packet-dcerpc-ndr.c
Next by Date: Re: [Ethereal-dev] capture_if_dlg.c has weird #if directive
Previous by thread: Re: [Ethereal-dev] ip.addr != display filter does not work with bcasts/mcasts?
Next by thread: Re: [Ethereal-dev] ip.addr != display filter does not work withbcasts/mcasts?
Index(es):
- Date
- Thread