Ethereal-dev: Re: [Ethereal-dev] ip.addr != 1.2.3.4 should work as expected

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: "John McDermott" <jjm@xxxxxxxxxx>
Date: Tue, 10 May 2005 11:25:33 -0600
On Mon, 09 May 2005 22:48:11 -0700, Guy Harris <gharris@xxxxxxxxx> wrote:
Some might wish "F != V" to mean "for all F, F.v != V" - but if we treat the "!=" operator specially, what do we do with ">", ">=", "<", and "<="? Or do we treat != as a special case?
Well, making != a special does make the expressions more DWIM (do what I mean) for the *average* Ethereal user. But as before I suggest a separate <> operator for that special case. I may be wrong, but my experience with novices indicates a lot of == and != use. I see very little >, < and friends used with ip.addr and {tcp,udp}.port. 

As long as were discussing new filter features, a college suggested

(ip.src & 255.255.128) == 1.2.3.128 type masking for addresses.

--john
--
John McDermott, CCP
Writer, Educator, Consultant
jjm@xxxxxxxxxx        www.jkintl.com
V: +1 505/377-6293  F: +1 505/377-6313