Wireshark-users: Re: [Wireshark-users] Filtering ICMP Packets Based on IP Addresses in the ICMP P
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Stephen Fisher <steve@xxxxxxxxxxxxxxxxxx>
Date: Sat, 30 May 2009 10:54:50 -0600
On Sat, May 30, 2009 at 09:24:22AM -0700, Merton Campbell Crockett wrote:

> In addition to looking at traffic to or from specific clients, I want 
> to look at any ICMP traffic that involves the specific client.  I've 
> used the following filter expression.
> 
> 	icmp or ip.addr eq 10.10.208.211
> 
> Unfortunately, this filter includes all ICMP traffic instead of just 
> the ICMP traffic that is related to 10.10.208.211.

Try "icmp and ip.addr eq 10.10.208.211" to find packets to/from that IP 
that are ICMP -and- packets that have ICMP packets containing traffic 
to/from that IP in the ICMP payload.

> Is there a way to filter ICMP traffic based on the IP, TCP, or UDP 
> headers that are being returned in the payload of the ICMP packet?

No, because it is handed by the IP dissector and then TCP/UDP 
dissectors.

> If not, is there a way to remove "uninteresting" packets from the 
> packet display pane?

Not easily.  You could add "!frame.number == #" to the display filter 
or mark certain packets and save only the marked ones or save ranges of 
packets in the save dialog.


Steve