In Wireshark, if I want to write a filter which accepts only ICMP destination unreachable ( type 3 ) messages, the filter is
icmp == 3 .
How do I count the packet offset of 0 in this instance ?
Based on the above image from Wikipedia, the ICMP type is under 0-7 bits. Therefore it is the first byte and therefore 0 ?