Wireshark · Wireshark-dev: Re: [Wireshark-dev] display filter on a field that appears more than once in a message

[Andrew Schweitzer <a.schweitzer.grps@xxxxxxxxx>]

Guy Harris wrote:
> ronnie sahlberg wrote:
>
> > The difference is the difference between the upside down A (==For ALL it 
> > is true)
> > and the mirrored E (==there EXISTS at least one)
>
>
> I.e.:
>
> 	payload.packet.a_field != 1
>
> means "there exists at least one instance of payload.packet.a_field in 
> the packet that has a value not equal to 1", not "all instances of 
> payload.packet.a_field in the packet have values not equal to 1", and 
> the negation of that is "all instances of payload.packet.a_field in the 
> packet have values equal to 1".
>
> 	payload.packet.a_field == 1
>
> means "there exists at least one instance of payload.packet.a_field with 
> a value equal to 1", which is not the opposite of "there exists at least 
> one instance of payload.packet.a_field in the packet that has a value 
> not equal to 1", i.e. it's not the opposite of
>
> 	payload.packet.a_field != 1

Thanks, this is very helpful. I can see now that the doc says this as well.