Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there a wireshark display filter that will find ICMP echo requests that didn't have a reply?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

In Wireshark, you can use the MATE plugin to achieve this functionality. I just tested with the latest version (1.6.0) and it's included in the default installation package.

First, create a text file to house the following configuration for MATE:

Pdu ping_pdu Proto icmp Transport ip {
    Extract addr From ip.addr;
    Extract icmp_type From icmp.type;
    Extract icmp_seq From icmp.seq;
};

Gop ping_pair On ping_pdu Match (addr, addr, icmp_seq) {
    Start (icmp_type=8);
    Stop (icmp_type=0);
};

Within Wireshark, go to the Preferences and find MATE in the protocol list. It has one configuration parameter, which is the location of the configuration file. Point it to where ever you saved the file you created with the content above.

At this point, you can restart Wireshark and make sure that MATE parses the configuration properly.

Now you can open up a capture and all of the ping requests and responses should have a bit of extra data titled "MATE" in the details pane. Each "ping_pdu" is grouped with it's counterpart as a "ping_pair".

Now apply the following filter:

mate.ping_pair.NumOfPdus==1

This will single out the "ping_pairs" which have only 1 member (i.e. a request with no response).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.