[LEGO <luis.ontanon@xxxxxxxxx>]

The rationale is pretty straightforward there's udp in the frame so it
matches "udp".

What you might want to do is filter with "udp and not icmp".

On Sun, 20 Mar 2005 12:14:27 -0800, Bob Snyder <bob.snyder@xxxxxxx> wrote:
> Why are ICMP packets displayed when a display filter is used that should
> exclude them?
> 
> For example, when running a traceroute, and with a display filter of
> "udp", in addition to the outbound UDP datagrams, the ICMP messages
> returned from each router are displayed as well. I know that the ICMP
> datagrams include the headers of the datagrams that are being reported
> on, but apparently their presence allows them to pass through the
> display filter. Is this behavior intentional? If so, what is the rationale?
> 
> Bob Snyder
> 
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users
> 


-- 
This information is top security. When you have read it, destroy yourself.
-- Marshall McLuhan