Wireshark-users: Re: [Wireshark-users] Question on filtering

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Mark <mark4246@xxxxxxxxx>
Date: Fri, 20 Jun 2008 17:04:31 -0700
Hello,
 
Below is an exmpale.  The whole string works great until I add the "and no IGMP" when I do that the rest of the statement returns, meaning its not filtered.
 
not arp and not dns and not ip.addr==10.5.50.62 and not ip.addr==10.5.50.255 and no IGMP
 
Thanks,


 
On Thu, Jun 19, 2008 at 1:29 PM, Christopher Hunt <chunt@xxxxxxxxxxxx> wrote:
Can you provide an example of the filter you're working with and a plain-english explanation of what you'd like to see or not see?
Christopher Hunt


Mark wrote:
Hello,

What is the main difference between 'and' and 'or'?  I am trying to filter out many different things like one particular IP addr, a certain protocol such as DNS and NBNS and ARP etc.  It seems like when I add multiple entries into a filter some appear again and I am sure its due to the 'and' or the 'or' usage.

Thanks,

Mark

_______________________________________________
Wireshark-users mailing list
Wireshark-users@xxxxxxxxxxxxx
https://wireshark.org/mailman/listinfo/wireshark-users