Wireshark-users: [Wireshark-users] finding a missing ICMP Echo Reply
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Stuart Kendrick <skendric@xxxxxxxxx>
Date: Fri, 05 Oct 2012 08:00:14 -0700
I have a trace tracking one station pinging another, across multiple days: 32,371 frames 

10.1.2.3    10.1.2.4    ICMP    Echo (ping) request
10.1.2.4    10.1.2.3    ICMP    Echo (ping) reply
10.1.2.3    10.1.2.4    ICMP    Echo (ping) request
10.1.2.4    10.1.2.3    ICMP    Echo (ping) reply
[...]

Somewhere in there is one missing ICMP Echo Reply

I want to find precisely where (when) this occurs.

Can you think of a Wireshark way to accomplish this?
[If not, then I'll write a little code to walk through a text version of the trace, looking for two back-to-back 'Echo (ping) request' lines ... but I'm hoping for something slightly faster.] 

--sk