Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Display filter and/or precedence

From: Jakub Zawadzki <darkjames-ws@xxxxxxxxxxxx>
Date: Fri, 9 Aug 2013 21:32:10 +0200
On Fri, Aug 09, 2013 at 11:41:59AM -0700, Gerald Combs wrote:
> Laura Chappell and Sean Walberg recently discovered that logical OR
> takes precedence over logical AND in display filters. Is there any
> reason we shouldn't reverse this so that we match the order of
> operations elsewhere (including BPF)?

I think in BPF they have the same priority, evaluated from left to right, check dump of:

'port 333 or port 444 and host 192.168.192' same '(port 333 or port 444) and host 192.168.192.1'
'host 192.168.192.1 and port 443 or port 333' same '(host 192.168.192.1 and port 443) or port 333'