This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

ICMP not showing up after filtering tcp.port

0

I was troubleshooting a network issue on a host remotely, I had the following filter set: ip.addr eq my.ip.addr and tcp.port !=#### I set the tcp.port to not equal the one LogMeIn was using so that I can see other traffic coming from me to the remote host that is not the remote desktop session. But it was filtering out my ICMP traffic to the host as well, not sure what I'm doing wrong here.

Thank you

asked 08 Jul '13, 16:51

reikokuko's gravatar image

reikokuko
11●2●2●3
accept rate: 0%

edited 08 Jul '13, 17:41

cmaynard's gravatar image

cmaynard ♦♦
9.4k●10●38●142

One Answer:

2

Since you specified a filter part that filters on a TCP port it will filter away ICMP because that is just not TCP (unless you get an ICMP error that quotes a TCP layer). You could change your filter to

ip.addr eq my.ip.addy and icmp or tcp.port !=####

answered 08 Jul '13, 16:59

Jasper's gravatar image

Jasper ♦♦
23.8k●5●51●284
accept rate: 18%