What does the filter !ip.addr==192.168.1.2 select?

• A. All packets except those involving IP address 192.168.1.2
• B. Only packets from 192.168.1.2
• C. All IP packets
• D. Packets with no IP address

Answer: (A)

This filter uses negation to invert which packets are shown. The ip.addr field matches packets that have an IP address on either end (source or destination). So ip.addr==192.168.1.2 would include any packet where 192.168.1.2 is involved. Putting a small exclamation in front flips that: you get all packets that do not involve 192.168.1.2. That includes both IP packets with different addresses and non-IP packets (since they don’t have an IP address, the match is false and the negation makes it true). In short, it shows everything except traffic to or from 192.168.1.2.