ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] Display filter and/or precedence

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 9 Aug 2013 12:26:53 -0700
On Aug 9, 2013, at 11:46 AM, Evan Huus <eapache@xxxxxxxxx> wrote:

> On Fri, Aug 9, 2013 at 2:41 PM, Gerald Combs <gerald@xxxxxxxxxxxxx> wrote:
>> Laura Chappell and Sean Walberg recently discovered that logical OR
>> takes precedence over logical AND in display filters. Is there any
>> reason we shouldn't reverse this so that we match the order of
>> operations elsewhere (including BPF)?
> 
> The fact they had to *discover* this is probably indicative of
> something,

It's probably indicative of several things, including the fact that some people (including me) don't have the priorities of AND and OR as hardwired into our brains as we have the priorities of multiple/divide and add/subtract, and always use parentheses to make it clear what we have in mind for Boolean expressions.

For me, at least, this applies to C-derived languages, pcap filters, and Wireshark display filters, for starters.  It's been ages since I've written FORTRAN code, so I don't know whether I even knew the relative priorities of .AND. and .OR.

> but +1 for being consistent with the rest of the world.

Yes.