Wireshark Network Analysis: The Official Wireshark Certified Network Analyst Study Guide by Laura Chappell & Gerald Combs

Author:Laura Chappell & Gerald Combs
Language: eng
Format: mobi, pdf
Tags: Security, Computers, Networking, Certification Guides, General
ISBN: 9781893939943
Publisher: podbooks.com, LLC
Published: 2012-03-01T08:00:00+00:00

Filter on ICMP and ICMPv6 Traffic

The capture filter syntax for ICMP and ICMPv6 traffic is simply icmp or icmp6, respectively.

The display filter syntax is simply icmp or icmpv6. The following lists additional ICMP and ICMPv6 display filters.

icmp.type==8

ICMP ping—echo request

icmp.type==8 || icmp.type==0

ICMP ping request or response

(icmp.type==8) && !(icmp.code==0)

Unusual ICMP ping packets (code field is not set at 0)—refer to Chapter 31: Detect Network Scanning and Discovery Processes

icmp.type==13 || icmp.type==15 || icmp.type==17

ICMP Timestamp Request, Information Request or Address Mask Request (possible OS fingerprinting)—refer to Chapter 31: Detect Network Scanning and Discovery Processes

tcp && icmp.type==3 && (icmp.code==1 || icmp.code==2 || icmp.code==3 || icmp.code==9 || icmp.code==10 || icmp.code==13)

ICMP Destination Unreachable response to a TCP handshake (possible firewalled TCP target)—this is a unique filter as it looks for a TCP header embedded after the ICMP header

icmp.type==11

ICMP Time to Live Exceeded (traceroute underway?)

icmp.type==3 and icmp.code==4

Fragmentation Needed, but Don’t Fragment Bit Set (path MTU discovery packet—don’t block this packet!)

icmpv6.type==133

ICMPv6 router solicitation

(ipv6.src==::) && (icmpv6.type==135)

ICMPv6 duplicate address test using ICMPv6 Neighbor Solicitation

icmpv6 && ipv6.src==fe80::85ed:bc2e:dfc8:e5c8

ICMPv6 packets from a particular IPv6 host

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.