Ethereal-dev: Re: [Ethereal-dev] ip.addr != display filter does not work withbcasts/mcasts?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: "Martin Regner" <martin.regner@xxxxxxxxx>
Date: Sun, 5 Sep 2004 11:24:47 +0200
Yaniv Kaul wrote:
> When trying to run:
> ip.addr != 1.2.3.4
> It didn't filter the packets:
> 1.2.3.4 -> 1.2.3.255
> 1.2.3.4 -> 224.2.223.232
> 
> Is that ok/known?

There are two ip.addr fields in the ip-header.

Read chapter 6.3.4  "A common mistake" in the Ethereal User guide

http://www.ethereal.com/docs/user-guide/ChWorkBuildDisplayFilterSection.html

The filter "! (ip.addr == 1.2.3.4)" is maybe want you should use
or "ip and !(ip.addr == 1.2.3.4)" (if you only want ip-packets).

Another alternative is to use "(ip.src != 1.2.3.4) and (ip.dst != 1.2.3.4)"