Wireshark-users: [Wireshark-users] ICMP packets with two pairs of source and destination ip addre

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: nangergong <nangergong@xxxxxxxxx>
Date: Wed, 6 Jun 2012 12:20:01 +0200
HI, all,
   
     I used tshark to parse a pcap file with icmp packets,
                  tshark -r icmp -T fields -e frame.number -e ip.src -e ip.dst
 
     and the results are something like this:

1    74.125.132.188    138.96.192.56
2    74.125.132.188    138.96.192.56
3    138.96.192.56,74.125.132.188    74.125.132.188,138.96.192.56
4    138.96.192.56,74.125.132.188    74.125.132.188,138.96.192.56
5    74.125.132.188    138.96.192.56
6    138.96.192.56,74.125.132.188    74.125.132.188,138.96.192.56
7    74.125.132.188    138.96.192.56
8    138.96.192.56,74.125.132.188    74.125.132.188,138.96.192.56
9    74.125.132.188    138.96.192.56
10    138.96.192.56,74.125.132.188    74.125.132.188,138.96.192.56
11    74.125.132.188    138.96.192.56
12    138.96.192.56,74.125.132.188    74.125.132.188,138.96.192.56


so , like 3, 4, 6,8,10,12 , there are two src ip addr and dst ip addr
what is the reason for this? thanks