Wireshark-dev: Re: [Wireshark-dev] ip.addr != 10.0.0.1
From: Guy Harris <[email protected]>
Date: Sun, 27 Jan 2008 14:57:56 -0800
Ulf Lamping wrote:

As I've written in my other mail, I would expect a dialog box in this case, saying something like "ip.addr != 10.0.0.1 is very certainly not what you want! Should I filter !(ip.addr == 10.0.0.1) instead, which results in ...".
That applies to *any* field when you do a "!=" comparison; it's not 
unique to ip.addr (that's probably the most common example, but tcp.port 
and udp.port are probably also somewhat common places where this 
surprises users).  If we're to pop up a warning, I'd pop it up for any 
use of "!=", and offer a "don't show this dialog any more" checkbox so 
that the user can say "OK, I understand now" and not be bothered in the 
future.