Wireshark Block 5 Practice Exam

This filter uses negation to invert which packets are shown. The ip.addr field matches packets that have an IP address on either end (source or destination). So ip.addr==192.168.1.2 would include any packet where 192.168.1.2 is involved. Putting a small exclamation in front flips that: you get all packets that do not involve 192.168.1.2. That includes both IP packets with different addresses and non-IP packets (since they don’t have an IP address, the match is false and the negation makes it true). In short, it shows everything except traffic to or from 192.168.1.2.