0

I want to filter the ICMP packets sent from my IP address in Wireshark.

I tried the following expression:

ip.src == xxx.xxx.xxx.xxx && icmp

But the problem is that it shows packets with ip.src = yyy.yyy.yyy.yyy
that were sent to ip.dst = xxx.xxx.xxx.xxx.

Improve this question

2 Answers 2

Reset to default
1

The problem is that ICMP type 11 (TTL expired) returns the IP header of the sent IP packet. So in order to fix it, we need to exclude the type 11 ICMP. 0b = 11 in decimal, so use this filter to fix it:

ip.src == xxx.xxx.xxx.xxx && !(icmp[0] == B ) && icmp
Improve this answer
1
  • 0b = 11 in decimal so we want to exclude the type 11 ICMP
    – 0xab3d
    Commented Dec 11, 2012 at 13:46
-1

try ip.dst != xxx.xxx.xxx.xxx && ip.src != xxx.xxx.xxx.xxx

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .