 | 1 | initial version |
Try ip.addr ~= 10.0.0.0/8 && !(ip.addr == 224.0.0.0/3)
It would be easy to miss in the upgrade from 3.4.12 -> 3.6.2: Wireshark 3.6.0 Release Notes
Several changes have been made to the display filter syntax: The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal.
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
