From 84a57cb2ebd2b9c7605bf56395d19d3be0a5feea Mon Sep 17 00:00:00 2001
From: Gerald Combs <gerald@wireshark.org>
Date: Tue, 8 Apr 2014 12:21:01 -0700
Subject: The "not DNS" filter used UDP in the description but matched against
 TCP. DNS runs over both so update the filter to exclude both.

Thanks to Yaron Fainstein for noticing this.

Change-Id: I0c4d1fef7f8d725bf656cca87ba5908893fff0b2
Reviewed-on: https://code.wireshark.org/review/1028
Reviewed-by: Gerald Combs <gerald@wireshark.org>
---
 dfilters | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'dfilters')

diff --git a/dfilters b/dfilters
index 3930f8d4c3..cb7aded1a1 100644
--- a/dfilters
+++ b/dfilters
@@ -8,7 +8,7 @@
 "IPX only" ipx
 "TCP only" tcp
 "UDP only" udp
-"UDP port isn't 53 (not DNS), don't use != for this!" !(tcp.port == 53)
+"Non-DNS" !(udp.port == 53 || tcp.port == 53)
 "TCP or UDP port is 80 (HTTP)" tcp.port == 80 || udp.port == 80
 "HTTP" http
 "No ARP and no DNS" not arp and !(udp.port == 53)
-- 
cgit v1.2.1