Wireshark · Ethereal-dev: Re: [ethereal-dev] 0.7.7: Problems filtering ip.addr with < or > operators

[Guy Harris <guy@xxxxxxxxxx>]

> E.g. trying to color code any IP packet leaving my local subnet
> (192.168.1.0/24) with the filter 
> "ip.addr < 192.168.1.0 || ip.addr > 192.168.1.255"

Hmm.

It (or, rather a test for stuff that included a host that *was* on the
local subnet) worked on a Solaris/SPARC machine, which suggests that it
might, indeed, be a byte-ordering problem.

The value is probably in the protocol tree in network byte order, which
is host byte order on SPARC but not host byte order on x86 (I'm
presuming your Linux box is a PC).

Of course, one could also argue that there should be a better way of
testing whether an IP address is on a given network;

	(ip.addr & 0xFFFFFF00) != 192.168.1.0

won't work, as we don't support arithmetic expressions in display
filters, but *some* way of asking for the network part of an address
might be useful....