Is there a wireshark display filter that will find ICMP echo requests that didn't have a reply?
In Wireshark, you can use the MATE plugin to achieve this functionality. I just tested with the latest version (1.6.0) and it's included in the default installation package.
First, create a text file to house the following configuration for MATE:
Within Wireshark, go to the Preferences and find MATE in the protocol list. It has one configuration parameter, which is the location of the configuration file. Point it to where ever you saved the file you created with the content above.
At this point, you can restart Wireshark and make sure that MATE parses the configuration properly.
Now you can open up a capture and all of the ping requests and responses should have a bit of extra data titled "MATE" in the details pane. Each "ping_pdu" is grouped with it's counterpart as a "ping_pair".
Now apply the following filter:
This will single out the "ping_pairs" which have only 1 member (i.e. a request with no response).