ronnie sahlberg wrote: > The difference is the difference between the upside down A (==For ALL it > is true) > and the mirrored E (==there EXISTS at least one)
I.e.: payload.packet.a_field != 1 means "there exists at least one instance of payload.packet.a_field in the packet that has a value not equal to 1", not "all instances of payload.packet.a_field in the packet have values not equal to 1", and the negation of that is "all instances of payload.packet.a_field in the packet have values equal to 1". payload.packet.a_field == 1 means "there exists at least one instance of payload.packet.a_field with a value equal to 1", which is not the opposite of "there exists at least one instance of payload.packet.a_field in the packet that has a value not equal to 1", i.e. it's not the opposite of payload.packet.a_field != 1 _______________________________________________ Wireshark-dev mailing list Wireshark-dev@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-dev