Wireshark-dev: Re: [Wireshark-dev] ip.addr !=
From: Ulf Lamping <[email protected]>
Date: Sun, 27 Jan 2008 16:50:15 +0100
Stig Bjørlykke schrieb:

We often get questions why the filter "ip.addr !=" does not
work as expected.

Is it a good idea to make some sort of special handling for filters
like "ip.addr", "tcp.port" and "udp.port" to expand to the commonly
expected behavior
Well, I don't know if a special filter handling is a good idea.

What was discussed some time ago was a warning if something like:

ip.addr !=

is used - as the result will most of the time not be what the user expected.

I've never took a deeper look into it, as I have very little experience with the filter engine.
Regards, ULFL