Wireshark · Ethereal-users: Re: [Ethereal-users] Filters

[Guy Harris <gharris@xxxxxxxxx>]

Ulf Lamping wrote:
> Carl.Knox@xxxxxxxxxxxxxxx wrote:
>
>
> > Display filters, in particular "ip.addr != x.x.x.x", use to work for both
> > src and dst addresses, but now I must make an elaborate formula to filter
> > both src and dst.
>
> This is a frequent mistake, use "!(ip.addr == x.x.x.x)", see
> http://wiki.ethereal.com/DisplayFilters

...but it's not a case of "used to work"; this didn't change recently - 
"ip.addr != x.x.x.x" has, for a long time, meant "neither the source nor 
the destination address of the packet has the value x.x.x.x", so that it 
can match a packet whose source address is x.x.x.x as long as the 
destination address isn't x.x.x.x or whose destination address is 
x.x.x.x as long as the source address is x.x.x.x.

Perhaps he should indicate what "ip.addr != x.x.x.x" did when it worked, 
and what he has to do now?