Benjamin M Stocks wrote: > Great! Thanks for the answer, as a follow up question: how does it work > when I want to filter on a header field? Will it match ANY of the fields?
Yes. A filter "foo.bar == X", for example, matches all packets that have at least one instance of a "foo.bar" field with the value "X. (This means, BTW, that the negation of "foo.bar == X" is *NOT* "foo.bar != X". "foo.bar != X" matches all packets that have at least one instance of a "foo.bar" field with a value other than X, but a packet could have one instance with the value "X" and another with the value "Y" and thus match *both* filters. The negation of "foo.bar == X" is "!(foo.bar == X)".) _______________________________________________ Wireshark-dev mailing list [email protected] http://www.wireshark.org/mailman/listinfo/wireshark-dev
