Wireshark · Wireshark-users: Re: [Wireshark-users] finding a missing ICMP Echo Reply

[Stuart Kendrick <skendric@xxxxxxxxx>]

Ahhh, I see ... icmp.resp_in is a flag set in ICMP Echo frames iff 
Wireshark can find the associated Response

And icmp.resp_to is a flag set in ICMP Echo Reply frames iff Wireshark 
can find the associated Request

That sounds like exactly what I want.

However.

(A)
"!(icmp.resp_in or icmp.resp_to) and (icmp.type==0 or icmp.type==8)" 
shows me 2992 frames ... most of which seem to be perfectly good 
request/response pairs

(B)
icmp.type==8 and !icmp.resp_in reports 1502 cases in which the Reply is 
missing ... but on manual examination, the first three are not accurate.

(C) My Perl code finds 33 situations where a Request is missing from a 
Reply or vice versa.  On manual inspection, the first three are accurate 
... I hope to crawl through the remainder, sanity checking them ...

If you'd like more detail, including the trace file:
https://vishnu.fhcrc.org/stuttered-icmp/


Wireshark 1.8.3 (SVN Rev 45256 from /trunk-1.8)

--sk

On 10/5/2012 9:08 AM, Martin Isaksson wrote:
> Hi Stuart,
>
> First I should say I am using Wureshark Version 1.8.2 (SVN Rev 44520 from /trunk-1.8).
>
> I took an old capture file with ICMP pings, deleted one reply with frame.number != X and saved.
> Then I used the filter below, and the only packet listed was the lone request.
>
> icmp.resp_in seems only to be present in frames that Wireshark can find the response to.
> The same for icmp.resp_to in the replies.
>
> !(icmp.resp_in or icmp.resp_to) should be equivalent. The filter suggested by Gerald works for me as well, and I like it more than mine :)
>
> Kind regards,
> Martin
>