Wireshark · Ethereal-dev: Re: [Ethereal-dev] ip.addr != display filter does not work withbcasts/mcasts?

[Alok <alokdube@xxxxxxxxxx>]

Hi,

Well this helped me figure out something I was seeing in my trace which 
didnt make sense..
thanks!!

just out of innane curiousity

when can i ever use ip.addr!=x.y.z.w in that case??
in other words if we do have an ip.addr!= option should it not be an 
implicit Source Or Destination



Martin Regner wrote:

> Yaniv Kaul wrote:
>  
>
> > When trying to run:
> > ip.addr != 1.2.3.4
> > It didn't filter the packets:
> > 1.2.3.4 -> 1.2.3.255
> > 1.2.3.4 -> 224.2.223.232
> >
> > Is that ok/known?
> >    
>
> There are two ip.addr fields in the ip-header.
>
> Read chapter 6.3.4  "A common mistake" in the Ethereal User guide
>
> http://www.ethereal.com/docs/user-guide/ChWorkBuildDisplayFilterSection.html
>
> The filter "! (ip.addr == 1.2.3.4)" is maybe want you should use
> or "ip and !(ip.addr == 1.2.3.4)" (if you only want ip-packets).
>
> Another alternative is to use "(ip.src != 1.2.3.4) and (ip.dst != 1.2.3.4)"
>
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
>
>