 | 1 | initial version |
Yes, this display filter behaviour has been enhanced to act more intuitively. So an expression as ip.addr != 10.43.54.65 does indeed now means that all contributing fields (ip.src and ip.dst) have to be unequal to the value for the expression to be true. The operator alias all_ne (all not equal) of != makes it even more clear.
To filter packets that come and go to the loopback address, the display filter expression ip.addr === 127.0.0.1 would match those packets. The operator alias all_eq (all equal) of === makes this even more clear.
Another example would be udp.port === 123 which matches NTP server to server packets.
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
