Wireshark-users: [Wireshark-users] question regarding display filters
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: "Simon Mullis" <simon@xxxxxxxxxxxx>
Date: Tue, 29 May 2007 17:27:00 +0100
Hi All,

Surely the two following filters are the same:

eth.src == XX:XX:XX:XX:01 AND eth.dst == XX.XX.XX.XX.02 AND tcp.dstport == 1234

eth.src == XX:XX:XX:XX:01 && eth.dst == XX.XX.XX.XX.02 && tcp.dstport == 1234

They all should be a logical 'AND'.

Why do I get differing results between the two filters?

I look at http://wiki.wireshark.org/DisplayFilters shows me that

AND == &&
OR == ||

Is this correct?  I would assume it should be!

I have a funny feeling I'm not understanding something...

Thanks in advance,

SM