Wireshark · Ethereal-dev: Re: [Ethereal-dev] ip.addr != 1.2.3.4 should work as expected

[Jaap Keuter <jaap.keuter@xxxxxxxxx>]

On Mon, 9 May 2005, Ulf Lamping wrote:

> Hi!
>
> Some filter strings like:
>
> ip.addr != 1.2.3.4
>
> doesn't work as expected (filter out packets to and from ip.addr
> 1.2.3.4), one must use:
>
> !(ip.addr == 1.2.3.4)
>
> instead (the same applies to tcp.port and alike "pseudo fields").
>
> Strictly speaking this might be grammatically correct, but it seems that
> this is a *very common* mistake, which should be avoided if possible IMHO.

Welcome to the wonderfull world of regular expressions.
For one they are very powerfull, on the other they can bite you.

> Would it be possible to change the current display filter so it would
> work as expected?

In a sense they do, but since a computer cannot understand the semantics
of whats expected, you're required to be syntactically accurate.

Check out http://wiki.ethereal.com/DisplayFilters which describes this
very example :-)

> I don't know the grammatics behind this, so I don't know how much effort
> this would be and I'm really not the person to change this (I personally
> hate flex/yacc and alike :-)
>
> So is there any reason that this shouldn't be changed, and maybe is
> there someone able to change it?

Yes there is. These regular expressions are well worked out in various
libraries, which are shared among numerous programs. This gives a constant
way of creating these expressions, which is a Good Thing(sm).

Be well,
Jaap