Wireshark-dev: Re: [Wireshark-dev] display filter on a field that appears more than once in a m

From: Andrew Schweitzer <a.schweitzer.grps@xxxxxxxxx>
Date: Thu, 07 Sep 2006 07:07:12 -0400
Guy Harris wrote:
ronnie sahlberg wrote:

The difference is the difference between the upside down A (==For ALL it is true)
and the mirrored E (==there EXISTS at least one)


I.e.:

	payload.packet.a_field != 1

means "there exists at least one instance of payload.packet.a_field in the packet that has a value not equal to 1", not "all instances of payload.packet.a_field in the packet have values not equal to 1", and the negation of that is "all instances of payload.packet.a_field in the packet have values equal to 1".

	payload.packet.a_field == 1

means "there exists at least one instance of payload.packet.a_field with a value equal to 1", which is not the opposite of "there exists at least one instance of payload.packet.a_field in the packet that has a value not equal to 1", i.e. it's not the opposite of

	payload.packet.a_field != 1

Thanks, this is very helpful. I can see now that the doc says this as well.