Ethereal-dev: Re: [Fwd: Re: [Ethereal-dev] Filter expressions for exclusion]

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <gharris@xxxxxxxxx>
Date: Tue, 31 Dec 2002 12:49:40 -0800
On Tue, Dec 31, 2002 at 07:52:31AM -0700, John McDermott wrote:
> OK.  I have to agree here.  I think 'tcp.port==80' should mean "tcp
> packets with source or destination ports with a value of 80' (as it
> does), but by the "filters shouldn't do things I don't ask for" rule,
> "tcp.port != 80" should not imply tcp packets.

What you asked for was packets whose TCP port had a value other than 80.

Non-TCP packets have no TCP port, so they obviously don't have a TCP
port with a value other than 80.

> I'm sorry to disagree
> with Guy, but if a packet does not have a TCP port, its tcp.port value is
> not 80 (it is undefined) and therefore it should match the expression.

So for which comparison operators should an undefined value match and
for which comparison operators should an undefined value not match? 
(There are more comparison operators than "==" and "!=".)