Ask Your Question
0

Difference between !(ip.addr == 192.0.2.1) and (ip.addr != 192.0.2.1)

asked 2018-02-20 19:07:31 +0000

this post is marked as community wiki

This post is a wiki. Anyone with karma >750 is welcome to improve it.

Regarding the filters in Wireshark, what is the differencebetween !(ip.addr == 192.0.2.1) and (ip.addr != 192.0.2.1)? When check the result, it's not giving the same result and I don't know why...

Plus, when I apply the filter (ip.addr != 192.0.2.1) appears a different color as background in filters (Yellow).

Does anyone can help me? Thanks in advance.

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
2

answered 2018-02-20 19:27:06 +0000

Guy Harris gravatar image

IP packets have two addresses - a source address and a destination address - and so have two ip.addr fields, one with the value of the source address and one with the value of the destination address.

"ip.addr == 192.0.2.1" means "match all packets that contain at least one instance of the ip.addr field with the value 192.0.2.1", so it will match packets from 192.0.2.1 and packets to 192.0.2.1.

"!(ip.addr == 192.0.2.1)" means "don't match any packets that contain at least one instance of the ip.addr field with the value 192.0.2.1", so it will not match packets from 192.0.2.1 or packets to 192.0.2.1.

"ip.addr != 192.0.2.1" means "match all packets that contain at least one instance of the ip.addr field with a value other than 192.0.2.1", so it will match packets from 192.0.2.1 that aren't going to 192.0.2.1, as the destination address will not be equal to 192.0.2.1, and will match packets to 192.0.2.1 that aren't from 192.0.2.1, as the source address will not be equal to 192.0.2.1.

Do NOT think of "{field} = {value}" as meaning "match only packets where the field {field} has the value {value}", and do NOT think of "{field} != {value}" as meaning "match only packets where the field {field} doesn't have the value {value}", because there is no guarantee that there is any such thing as "the field {field}". There can be multiple instances of a field in a packet; "{field} = {value}" means "match packets where there exists an instance of the field {field} that has the value {value}", and "{field} != {value}" means "match packets where there exists an instance of the field {field} that does not have the value {value}" (and the same applies to other comparison operators. The opposite for "there exists an X such that property Y applies to X" is not "there exists an X such that property Y does not apply to X", it's "for all X, property Y does not apply to X".

edit flag offensive delete link more

Comments

And the yellow background is to warn you about this possibly non-intuitive expression.

Jaap gravatar imageJaap ( 2018-02-20 20:55:07 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2018-02-20 19:07:31 +0000

Seen: 324 times

Last updated: Feb 20