[Gilbert Ramirez <gilbertr@xxxxxxxxx>]

So, maybe we need a different "==". One that means "there exists an x
that is equal to y", and one that means "all x's equal y". Trying to
borrow from logic, we could use "A" and "E":

A(ip.addr) == 1.2.3.4
E(ip.addr) == 1.2.3.4

--gilbert

On 5/9/05, Jaap Keuter <jaap.keuter@xxxxxxxxx> wrote:
> On Mon, 9 May 2005, Ulf Lamping wrote:
> 
> > Hi!
> >
> > Some filter strings like:
> >
> > ip.addr != 1.2.3.4
> >
> > doesn't work as expected (filter out packets to and from ip.addr
> > 1.2.3.4), one must use:
> >
> > !(ip.addr == 1.2.3.4)
> >
> > instead (the same applies to tcp.port and alike "pseudo fields").
> >
> > Strictly speaking this might be grammatically correct, but it seems that
> > this is a *very common* mistake, which should be avoided if possible IMHO.
> 
> Welcome to the wonderfull world of regular expressions.
> For one they are very powerfull, on the other they can bite you.
> 
> > Would it be possible to change the current display filter so it would
> > work as expected?
> 
> In a sense they do, but since a computer cannot understand the semantics
> of whats expected, you're required to be syntactically accurate.
> 
> Check out http://wiki.ethereal.com/DisplayFilters which describes this
> very example :-)
> 
> > I don't know the grammatics behind this, so I don't know how much effort
> > this would be and I'm really not the person to change this (I personally
> > hate flex/yacc and alike :-)
> >
> > So is there any reason that this shouldn't be changed, and maybe is
> > there someone able to change it?
> 
> Yes there is. These regular expressions are well worked out in various
> libraries, which are shared among numerous programs. This gives a constant
> way of creating these expressions, which is a Good Thing(sm).
> 
> Be well,
> Jaap
> 
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
> 
>