Ethereal-dev: Re: [Ethereal-dev] ip.addr != 1.2.3.4 should work as expected

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: "John McDermott" <jjm@xxxxxxxxxx>
Date: Tue, 10 May 2005 08:03:25 -0600
On Mon, 09 May 2005 23:13:00 -0700, Guy Harris <gharris@xxxxxxxxx> wrote:


John McDermott wrote:
While ip.addr != x is probably not meaningful; tcp.port != x might be (some tcp or udp protocols use the same port on both ends sometimes, perhaps). 
 How about ip.addr <> x to mean "neither src nor dst == x"?
Or "ip.addr <> x" means "for all instances of ip.addr, the value of the instance is not x" (and "ip.src <> x" means "for all instances of ip.src, the value of the instance is not x", etc.). 

Yes.  I like that. It helps with the ICMP and IP in IP issues.

--john


--
John McDermott, CCP
Writer, Educator, Consultant
jjm@xxxxxxxxxx        www.jkintl.com
V: +1 505/377-6293  F: +1 505/377-6313