This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I have a large capture with thousands of PINGS. I know at one time i saw Request timed out on the node i was monitoring, indicating it never received a reply for those PINGS. Can i use a Wireshark filter to find the Requests that never received a Reply?

asked 11 Dec '12, 13:20

philliplew's gravatar image

philliplew
6112
accept rate: 0%


You can try using "not icmp.resp_in and icmp.type==8" which will give you all icmp requests where wireshark doesn't have the according response inside the capture file

permanent link

answered 11 Dec '12, 13:26

Landi's gravatar image

Landi
2.3k51442
accept rate: 28%

This worked great thank you. My only issue was i was Port Mirroring on my Switch 2 ports (source server and gateway) so i had two instances of each packet, 1 from each Switch port.

This meant Wireshark found 1 instance of every packet without a matching reply.

Luckily there were few enough packets after applying the above filter that i could manually go down the list and find the occurrences where there were 2.

Thanks again.

(11 Dec '12, 13:55) philliplew

(based on sequence number BE)

(11 Dec '12, 13:56) philliplew
1

You could use editcap -d to remove duplicate packets before analyzing them. editcap is a command line tool that can be found in the wireshark installation directory.

(11 Dec '12, 13:58) Jasper ♦♦

Thank you very much¡ I was searching in a 201998 packets file and found out 313 w/o answer¡ All of this in 5 minutes thank you¡¡

(09 Mar '15, 07:36) paristiz
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×74
×40

question asked: 11 Dec '12, 13:20

question was seen: 30,988 times

last updated: 09 Mar '15, 07:57

p​o​w​e​r​e​d by O​S​Q​A