2

Is there a wireshark display filter that will find ICMP echo requests that didn't have a reply?

1 Answer 1

2

In Wireshark, you can use the MATE plugin to achieve this functionality. I just tested with the latest version (1.6.0) and it's included in the default installation package.

First, create a text file to house the following configuration for MATE:

Pdu ping_pdu Proto icmp Transport ip {
    Extract addr From ip.addr;
    Extract icmp_type From icmp.type;
    Extract icmp_seq From icmp.seq;
};

Gop ping_pair On ping_pdu Match (addr, addr, icmp_seq) {
    Start (icmp_type=8);
    Stop (icmp_type=0);
};

Within Wireshark, go to the Preferences and find MATE in the protocol list. It has one configuration parameter, which is the location of the configuration file. Point it to where ever you saved the file you created with the content above.

At this point, you can restart Wireshark and make sure that MATE parses the configuration properly.

Now you can open up a capture and all of the ping requests and responses should have a bit of extra data titled "MATE" in the details pane. Each "ping_pdu" is grouped with it's counterpart as a "ping_pair".

Now apply the following filter:

mate.ping_pair.NumOfPdus==1

This will single out the "ping_pairs" which have only 1 member (i.e. a request with no response).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .