Wireshark · Wireshark-dev: Re: [Wireshark-dev] ip.addr != 10.0.0.1 (Guy Harris)

[Jaap Keuter <jaap.keuter@xxxxxxxxx>]

Hi,

In this discussion you miss the tunneled protocols, or messages like ICMP

Thanx,
Jaap

Stig Bjørlykke wrote:
> 2008/1/29, Sake Blok <sake@xxxxxxxxxx>:
> > I would vote for a preference value that defaults to make
> > ip != 10.0.0.1 result in !(ip.addr==10.0.0.1).
>
> For most of the fields in Wireshark we need the "x!=y" and "!(x==y)"
> operators as they are, exactly because they have different behavior.
> I do not want to change this.
>
> The problem, as I see it, is the combined fields which matches two
> different fields, like ip.addr, tcp.port, udp.port and probably some
> others, where the user has other expectations how they work.  So I
> think we shall focus on them and not the operators.
>
> When I think of ip.addr I'm thinking "they", as in ip.src and ip.dst.
> When I write ip.addr != 10.0.0.1 I'm thinking "they shall not be
> 10.0.0.1", as in none of them.  This is because the field matches two
> different fields I want to filter out.  The same goes with LT and GT.
>
> Our combined fields should be marked as combined (in the source), and
> only this fields should be handled differently, or simply just give a
> warning to the user why they will not work as expected.
>
> But does it make the functionality difficult to understand or describe
> correctly?