Wireshark · Wireshark-dev: Re: [Wireshark-dev] Re-use of header fields

[Guy Harris <guy@xxxxxxxxxxxx>]

Benjamin M Stocks wrote:

> Great! Thanks for the answer, as a follow up question: how does it work 
> when I want to filter on a header field? Will it match ANY of the fields?

Yes.  A filter "foo.bar == X", for example, matches all packets that 
have at least one instance of a "foo.bar" field with the value "X.

(This means, BTW, that the negation of "foo.bar == X" is *NOT* "foo.bar 
!= X".  "foo.bar != X" matches all packets that have at least one 
instance of a "foo.bar" field with a value other than X, but a packet 
could have one instance with the value "X" and another with the value 
"Y" and thus match *both* filters.  The negation of "foo.bar == X" is 
"!(foo.bar == X)".)