"ip.DstAddr >= 0.0.0.0" ---> "ip" "ip.DstAddr < 0.0.0.0" ---> "false" Previously, the latter simplified to "not ip".