This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Why Doesn’t This Filter Work?

I want to see results where neither the destination, nor the source are the specified address; here is my filter. ip.src != 192.168.1.119 && ip.dst != 192.168.1.119

To my surprise, it returns some results with the that IP, such as this one: 157 238.065591 192.168.1.1 192.168.1.119 ICMP Destination unreachable (Port unreachable)

The destination on this result is clearly one the filter should have blocked. What's up?

filter logic

asked 23 Nov '10, 16:50

ActualRandy
46●2●2●4
accept rate: 0%

2 Answers:

Use !ip.addr==192.168.1.119 and that will work.

Laura

answered 23 Nov '10, 17:06

lchappell ♦
1.2k●2●7●30
accept rate: 8%

Hi Laura -

You are correct, your filter does work, and I still don't understand why my filter doesn't work - I suspect it is a bug. But, of course, that wouldn't be your responsibility!

(23 Nov '10, 17:30) ActualRandy

Filtering OUT based on IP address plagues everyone (see section 6.4.4 of the Wireshark User Manual). The developers even put in a sample display filter on that one with a note not to use != and made the yellow background. They tried to do everything short of flying/driving to your office/home, walking up to your desk and slapping you on the wrist. Grin.

(23 Nov '10, 18:45) lchappell ♦

The problem with a logical filter like "ip.src != 192.168.1.119 && ip.dst != 192.168.1.119" is that while it may work for packets that only have one ip.src and ip.dst, it won't work like expected when there are more occurrences of those fields.

The maining of "ip.src!=192.168.1.119" is: "Match all packets where there is a field ip.src with a value other than 192.168.1.119".

In your case, the ICMP message contains to IP layers. Wheneven a system sends out an ICMP port unreachable message, it includes the IP header of the original packet that could not be delivered. That packet most probably had the ip.src and ip.dst reversed from the ip.src and ip.dst of the icmp message.

So there now is a field ip.src that does not match 192.168.1.119 and also a field ip.dst that does not match 192.168.1.119.

When you use "!ip.addr==192.168.1.119" it means there is not a field ip.addr with value 192.168.1.119. So that will work on all four fields ip.addr in your packet.

As Laura said, be careful with these filters, when a filter turns yellow, Wireshark tells you to pay attention. And the Wiki and the User's guide are always great places to explore.

answered 23 Nov '10, 23:49

SYN-bit ♦♦
17.1k●9●57●245
accept rate: 20%