Wireshark · Wireshark-dev: Re: [Wireshark-dev] display filter on a field that appears more than once in a message

[Guy Harris <guy@xxxxxxxxxxxx>]

ronnie sahlberg wrote:
> The difference is the difference between the upside down A (==For ALL it 
> is true)
> and the mirrored E (==there EXISTS at least one)

I.e.:

	payload.packet.a_field != 1

means "there exists at least one instance of payload.packet.a_field in 
the packet that has a value not equal to 1", not "all instances of 
payload.packet.a_field in the packet have values not equal to 1", and 
the negation of that is "all instances of payload.packet.a_field in the 
packet have values equal to 1".

	payload.packet.a_field == 1

means "there exists at least one instance of payload.packet.a_field with 
a value equal to 1", which is not the opposite of "there exists at least 
one instance of payload.packet.a_field in the packet that has a value 
not equal to 1", i.e. it's not the opposite of

	payload.packet.a_field != 1