Wireshark-dev: Re: [Wireshark-dev] ip.addr != 10.0.0.1
From: Ulf Lamping <[email protected]>
Date: Sun, 27 Jan 2008 16:50:15 +0100
Stig Bjørlykke schrieb:
Hi.

We often get questions why the filter "ip.addr != 10.0.0.1" does not
work as expected.

Is it a good idea to make some sort of special handling for filters
like "ip.addr", "tcp.port" and "udp.port" to expand to the commonly
expected behavior
Well, I don't know if a special filter handling is a good idea.


What was discussed some time ago was a warning if something like:

ip.addr !=

is used - as the result will most of the time not be what the user expected.


I've never took a deeper look into it, as I have very little experience with the filter engine.
Regards, ULFL