Wireshark · Wireshark-dev: Re: [Wireshark-dev] ip.addr != 10.0.0.1

[Jaap Keuter <jaap.keuter@xxxxxxxxx>]

Stig Bjørlykke wrote:
> Hi.
>
> We often get questions why the filter "ip.addr != 10.0.0.1" does not
> work as expected.
>
> Is it a good idea to make some sort of special handling for filters
> like "ip.addr", "tcp.port" and "udp.port" to expand to the commonly
> expected behavior?

Hi,

I'm very much opposed to it. Boolean logic can be a somewhat tricky, but 
when you master the math it becomes a powerful tool. Wireshark is a 
powetool. Therefor we have to educate the users, by teaching them how to 
use it. The Wiki is a good place, and can always be improved upon, so it 
can be the primary reference to the subject.

Thanx,
Jaap