Ask Your Question
0

!ip.addr vs ip.addr !=

asked 2022-11-10 10:50:12 +0000

Reviewing the following links:

They explain why

ip.addr != 10.43.54.65 is different from !ip.addr == 10.43.54.65

They say that

ip.addr != 10.43.54.65

is equivalent to

ip.src != 10.43.54.65 or ip.dst != 10.43.54.65

The problem is that doing test in latest wireshark version 4.0.0 this do not seem to be true. If you use the display filter

ip.addr != 192.168.1.72

image description

it does hide paquets with ip.src or ip.dst equals to 192.168.1.72, same happens with the filter

!ip.addr == 192.168.1.72

image description

But if you use the filter

ip.src != 192.168.1.72 or ip.addr != 192.168.1.72

I can se packets with ip.src or ip.dst equals to 192.168.1.72, it only filter packets with ip.src AND ip.dst equals to 192.168.1.72

image description

This is not the intended behaviour attending to wireshark wiki. What is wrong with this display filters?

Regards

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2022-11-10 16:07:15 +0000

Jaap gravatar image

If you've been following the news you might have picked up that the display filter engine has undergone some rigorous rework in the latest Wireshark release. One of the more obvious changes is the change in interpretation of the != operator. Where it used to be interpreted as "any not equal", it is now interpreted as "all not equal".

edit flag offensive delete link more

Comments

yes, you are right! So in the wiki (https://wiki.wireshark.org/DisplayFil...) they should change the operator != for !== .

dherrero gravatar imagedherrero ( 2022-11-10 16:19:54 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2022-11-10 10:50:12 +0000

Seen: 59 times

Last updated: Nov 10 '22