Reviewing the following links:
- https://ask.wireshark.org/question/1751/difference-between-ipaddr-192021-and-ipaddr-192021/
- https://wiki.wireshark.org/DisplayFilters.md#gotchas
They explain why
ip.addr != 10.43.54.65 is different from !ip.addr == 10.43.54.65
They say that
ip.addr != 10.43.54.65
is equivalent to
ip.src != 10.43.54.65 or ip.dst != 10.43.54.65
The problem is that doing test in latest wireshark version 4.0.0 this do not seem to be true. If you use the display filter
ip.addr != 192.168.1.72
it does hide paquets with ip.src or ip.dst equals to 192.168.1.72, same happens with the filter
!ip.addr == 192.168.1.72
But if you use the filter
ip.src != 192.168.1.72 or ip.addr != 192.168.1.72
I can se packets with ip.src or ip.dst equals to 192.168.1.72, it only filter packets with ip.src AND ip.dst equals to 192.168.1.72
This is not the intended behaviour attending to wireshark wiki. What is wrong with this display filters?
Regards
