RE: [Ethereal-users] 0.9.3:Display Filters Not Working

[Jeff Foster <jfoste@xxxxxxxxxxxx>]

From: Scott Fringer [mailto:fringsm@xxxxxxxxxxxxxxxxx]
Sent: Tuesday, April 02, 2002 3:28 PM

>   When I attempt to use a nondiscretionary port filter (tcp.port != xxx),
> it does not get applied.  However, if I build the filter using both
> tcp.srcport != xxx and tcp.dstport != xxx it works fine.
>   I noted the same behavior with ip.addr != xxx not filtering as expected
> but using ip.src != xxx and ip.dst != xxx works.
>   Anyone else seeing this behavior?

Common mistake, both the source and destination ports are added
to the protocol tree as tcp.port, so tcp.port != xxx will be 
true because it will match one of the ports. This assume the ports
aren't the same. 

Try the filter -

	!(tcp.port == xxx)

and you should get the results that you expect.

Jeff Foster

***
The information in this e-mail is confidential and intended solely for the
individual or entity to whom it is addressed. If you have received this
e-mail in error please notify the sender by return e-mail, delete this
e-mail, and refrain from any disclosure or action based on the information.
****