Stig Bjørlykke schrieb:
Hi.
We often get questions why the filter "ip.addr != 10.0.0.1" does not
work as expected.
Is it a good idea to make some sort of special handling for filters
like "ip.addr", "tcp.port" and "udp.port" to expand to the commonly
expected behavior
Well, I don't know if a special filter handling is a good idea.
What was discussed some time ago was a warning if something like:
ip.addr !=
is used - as the result will most of the time not be what the user expected.
I've never took a deeper look into it, as I have very little experience
with the filter engine.
Regards, ULFL