Wireshark-dev: Re: [Wireshark-dev] display filter on a field that appears more than once in a m
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Andrew Schweitzer <a.schweitzer.grps@xxxxxxxxx>
Date: Wed, 06 Sep 2006 21:02:38 -0400
ronnie sahlberg wrote:
The difference is the difference between the upside down A (==For ALL it is true) 
and the mirrored E (==there EXISTS at least one)
I.e. payload.packet.a_field != 1 
is only the same as
!(payload.packet.a_field == 1)

if this field exists exactly once in the set.

If the field exists multiple times   then
payload.packet.a_field != 1
is no longer the same as
!(payload.packet.a_field == 1)


try rewriting your filters to be
!(payload.packet.a_field==1)
instead



Awesome, it worked, thanks.