Wireshark-users: [Wireshark-users] Filtering ICMP Packets Based on IP Addresses in the ICMP Paylo
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Merton Campbell Crockett <m.c.crockett@xxxxxxxxxxxxxx>
Date: Sat, 30 May 2009 09:24:22 -0700
I've used Ethereal and Wireshark for a number of years to either capture or analyze network traffic. I am looking at a problem involving one of our servers. I have used a Cisco NAM to capture all traffic to or from the server.
In addition to looking at traffic to or from specific clients, I want to look at any ICMP traffic that involves the specific client. I've used the following filter expression. 

	icmp or ip.addr eq 10.10.208.211
Unfortunately, this filter includes all ICMP traffic instead of just the ICMP traffic that is related to 10.10.208.211.
Is there a way to filter ICMP traffic based on the IP, TCP, or UDP headers that are being returned in the payload of the ICMP packet?
If not, is there a way to remove "uninteresting" packets from the packet display pane? 

Merton Campbell Crockett
m.c.crockett@xxxxxxxxxxxxxx