This may be what you want….
ip.addr==192.168.2.34 and !(ip.addr==10.1.10.150
or ip.addr==10.1.11.140)
From:
wireshark-users-bounces@xxxxxxxxxxxxx [mailto:wireshark-users-bounces@xxxxxxxxxxxxx]
On Behalf Of Parkis, Scott
Sent: Wednesday, March 25, 2009 1:42 PM
To: wireshark-users@xxxxxxxxxxxxx
Subject: [Wireshark-users] What is wrong with this filter?
p.addr==192.168.2.34 and (ip.addr!=10.1.10.150 and
ip.addr!=10.1.11.140)
I want to show all packets src and/or dest from 2.34 but I do
not want any packets to/from 10.150 and 11.140. I tried it with and without the
() but it still shows me results with those two 10.1.x.x.
Thanks,
