Wireshark 过滤器 : Difference between ! (ip.addr == 192.0.2.1) 和 (ip.addr != 192.0.2.1)

Question

关于 Wireshark 中的过滤器，!(ip.addr == 192.0.2.1) 和 (ip.addr != 192.0.2.1) 有什么区别？检查结果时，结果不一样，我不知道为什么...

另外，当我应用过滤器 (ip.addr != 192.0.2.1) 时，在过滤器中显示与背景不同的颜色(黄色)。 image

有人能帮帮我吗？提前致谢。

Answer 1

在 bool 逻辑中，A not equals B 和not A equals B 是同一个测试。

但是，WireShark documentation linked by Jürgen Thelen 的相关部分解释说在 WireShark 中，ip.addr 涵盖了源和目标字段，因此测试更像是:

not ((A or B) equals C)

它过滤源或目标匹配的数据包，然后(正确地)隐藏它们。

相比于:

(A or B) not equals C

它过滤源或目标不是 C 的数据包，这是每个数据包，所以它显示每个数据包。

6.4.6. A Common Mistake Using the != operator on combined expressions like eth.addr, ip.addr, tcp.port, and udp.port will probably not work as expected.

Often people use a filter string to display something like ip.addr == 1.2.3.4 which will display all packets containing the IP address 1.2.3.4.

Then they use ip.addr != 1.2.3.4 to see all packets not containing the IP address 1.2.3.4 in it. Unfortunately, this does not do the expected.

Instead, that expression will even be true for packets where either source or destination IP address equals 1.2.3.4. The reason for this, is that the expression ip.addr != 1.2.3.4 must be read as “the packet contains a field named ip.addr with a value different from 1.2.3.4”. As an IP datagram contains both a source and a destination address, the expression will evaluate to true whenever at least one of the two addresses differs from 1.2.3.4.

它采用黄色背景的原因是因为这种潜在的令人惊讶的行为，并且在屏幕底部的状态栏中有一个匹配的警告，建议查看用户指南以获取更多详细信息: