["John McDermott" <jjm@xxxxxxxxxx>]

While ip.addr != x is probably not meaningful; tcp.port != x might be  
(some tcp or udp protocols use the same port on both ends sometimes,  
perhaps).

How about ip.addr <> x to mean "neither src nor dst == x"?

--john

On Mon, 09 May 2005 22:45:17 +0200, Ulf Lamping <ulf.lamping@xxxxxx> wrote:
> Some filter strings like:
>
> ip.addr != 1.2.3.4
>
> doesn't work as expected (filter out packets to and from ip.addr
> 1.2.3.4), one must use:
>
> !(ip.addr == 1.2.3.4)
>
> instead (the same applies to tcp.port and alike "pseudo fields").
>
> Strictly speaking this might be grammatically correct, but it seems that
> this is a *very common* mistake, which should be avoided if possible  
> IMHO.
w.ethereal.com/mailman/listinfo/ethereal-dev
>



--
John McDermott, CCP
Writer, Educator, Consultant
jjm@xxxxxxxxxx        www.jkintl.com
V: +1 505/377-6293  F: +1 505/377-6313