Wireshark · Wireshark-users: Re: [Wireshark-users] Question on filtering

[Mark <mark4246@xxxxxxxxx>]

Hello,

 

Below is an exmpale.  The whole string works great until I add the "and no IGMP" when I do that the rest of the statement returns, meaning its not filtered.

 

not arp and not dns and not ip.addr==10.5.50.62 and not ip.addr==10.5.50.255 and no IGMP

 

Thanks,

 

On Thu, Jun 19, 2008 at 1:29 PM, Christopher Hunt <chunt@xxxxxxxxxxxx> wrote:

Can you provide an example of the filter you're working with and a plain-english explanation of what you'd like to see or not see?

Christopher Hunt

Mark wrote:

Hello,

What is the main difference between 'and' and 'or'?  I am trying to filter out many different things like one particular IP addr, a certain protocol such as DNS and NBNS and ARP etc.  It seems like when I add multiple entries into a filter some appear again and I am sure its due to the 'and' or the 'or' usage.

Thanks,

Mark

_______________________________________________
Wireshark-users mailing list
Wireshark-users@xxxxxxxxxxxxx
https://wireshark.org/mailman/listinfo/wireshark-users