Wireshark-dev: Re: [Wireshark-dev] Re-use of header fields
From: Guy Harris <[email protected]>
Date: Wed, 09 Aug 2006 12:44:01 -0700
Benjamin M Stocks wrote:

Great! Thanks for the answer, as a follow up question: how does it work when I want to filter on a header field? Will it match ANY of the fields?
Yes.  A filter "foo.bar == X", for example, matches all packets that 
have at least one instance of a "foo.bar" field with the value "X.
(This means, BTW, that the negation of "foo.bar == X" is *NOT* "foo.bar 
!= X".  "foo.bar != X" matches all packets that have at least one 
instance of a "foo.bar" field with a value other than X, but a packet 
could have one instance with the value "X" and another with the value 
"Y" and thus match *both* filters.  The negation of "foo.bar == X" is 
"!(foo.bar == X)".)