Wireshark-users: Re: [Wireshark-users] Question on filtering
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 20 Jun 2008 18:58:45 -0700

On Jun 20, 2008, at 5:05 PM, Mark wrote:
Below is an exmpale. The whole string works great until I add the "and no IGMP" when I do that the rest of the statement returns, meaning its not filtered.
not arp and not dns and not ip.addr==10.5.50.62 and not ip.addr==10.5.50.255 and no IGMP
That filter is rejected by a recent version of Wireshark, and should be rejected by all versions of Wireshark unless they have a bug in the filtering code; you have to change the stuff at the end to "and not igmp" ("not" rather than "no", "igmp" rather than "IGMP") before it's accepted.
Do you not get an error in your version of Wireshark? If you don't, what version is it?
Or did you actually type "not igmp" rather than "no IGMP" in the expression you used in Wireshark?