Ask Your Question

Revision history [back]

!ip.addr vs ip.addr !=

Reviewing the following links:


They explain why

ip.addr != is different from !ip.addr ==

They say that

ip.addr !=

is equivalent to

ip.src != or ip.dst !=

The problem is that doing test in latest wireshark version 4.0.0 this do not seem to be true. If you use the display filter

ip.addr !=

image description

it does hide paquets with ip.src or ip.dst equals to, same happens with the filter

!ip.addr ==

image description

But if you use the filter

ip.src != or ip.addr !=

I can se packets with ip.src or ip.dst equals to, it only filter packets with ip.src AND ip.dst equals to

image description

This is not the intended behaviour attending to wireshark wiki. What is wrong with this display filters?