[Guy Harris <gharris@xxxxxxxxx>]

John McDermott wrote:

> While ip.addr != x is probably not meaningful; tcp.port != x might be  
> (some tcp or udp protocols use the same port on both ends sometimes,  
> perhaps).
>
> How about ip.addr <> x to mean "neither src nor dst == x"?

Or "ip.addr <> x" means "for all instances of ip.addr, the value of the 
instance is not x" (and "ip.src <> x" means "for all instances of 
ip.src, the value of the instance is not x", etc.).