Aus wireshark-filter.html, eigentlich allgemein, paßt aber hier auch speziell:
A special caveat must be given regarding fields that occur more than once
per packet. "ip.addr" occurs twice per IP packet, once for the source
address, and once for the destination address. Likewise, "tr.rif.ring"
fields can occur more than once per packet. The following two expressions
are not equivalent:
ip.addr ne 192.168.4.1
not ip.addr eq 192.168.4.1
The first filter says "show me packets where an ip.addr exists that does
not equal 192.168.4.1". That is, as long as one ip.addr in the packet does
not equal 192.168.4.1, the packet passes the display filter. The other
ip.addr could equal 192.168.4.1 and the packet would still be displayed.
The second filter says "don't show me any packets that have an ip.addr
field equal to 192.168.4.1". If one ip.addr is 192.168.4.1, the packet
does not pass. If neither ip.addr field is 192.168.4.1, then the packet is
It is easy to think of the 'ne' and 'eq' operators as having an implict
"exists" modifier when dealing with multiply-recurring fields. "ip.addr ne
192.168.4.1" can be thought of as "there exists an ip.addr that does not
equal 192.168.4.1". "not ip.addr eq 192.168.4.1" can be thought of as
"there does not exist an ip.addr equal to 192.168.4.1".
Be careful with multiply-recurring fields; they can be confusing.
Care must also be taken when using the display filter to remove noise from
the packet trace. If, for example, you want to filter out all IP multicast
packets to address 18.104.22.168, then using:
ip.dst ne 22.214.171.124
may be too restrictive. Filtering with "ip.dst" selects only those IP
packets that satisfy the rule. Any other packets, including all non-IP
packets, will not be displayed. To display the non-IP packets as well, you
can use one of the following two expressions:
not ip or ip.dst ne 126.96.36.199
not ip.addr eq 188.8.131.52
The first filter uses "not ip" to include all non-IP packets and then lets
"ip.dst ne 184.108.40.206" filter out the unwanted IP packets. The second
filter has already been explained above where filtering with multiply
occuring fields was discussed.
!(ip.addr == 192.168.10.255)
das gewünschte, statt
ip.addr != 192.168.10.255.
Auch könnte das Format
A || B && C
ein Problem sein.
Ich versuche Gruppierung:
(ip.addr == 192.168.10.2 || ip.addr == 192.168.10.3) && not ip.addr == 192.168.10.255