Wireshark-users: Re: [Wireshark-users] finding a missing ICMP Echo Reply

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Stuart Kendrick <skendric@xxxxxxxxx>
Date: Fri, 05 Oct 2012 08:35:37 -0700
I'm stumbling on this.

Filtering on icmp.resp_in shows me all the Requests
Filtering on icmp.resp_to shows me all the Replies

Filtering on !icmp.resp_in shows me everything
Filtering on !icmp.resp_to shows me everything

Filtering on "!icmp.resp_in and !icmp_resp_to" shows me everything
Reading the description of these expressions ... I don't understand what they do: 

icmp_resp_in - Response In (the response to this request is in this frame)
    How can an ICMP Request and an ICMP Reply share the same frame?
icmp_resp_to = Response To (This is the response to the request in this frame) 
    How do I specify which request?

Would you elaborate?

--sk

On 10/5/2012 8:22 AM, Martin Isaksson wrote:

Hi Stuart!

!icmp.resp_in and !icmp.resp_to

There might be an easier way :)

/M