Caculating packet offset

icmppacketwireshark

In Wireshark, if I want to write a filter which accepts only ICMP destination unreachable ( type 3 ) messages, the filter is icmp[0] == 3 .

How do I count the packet offset of 0 in this instance ?

EDIT

enter image description here

Based on the above image from Wikipedia, the ICMP type is under 0-7 bits. Therefore it is the first byte and therefore 0 ?

Best Answer

Your filter is correct, icmp[0] indeed matches the first byte of the ICMP header containing the type. However, I find it hard to read, you should use icmp.type eq 3 instead. This is also much easier when the field is longer than one byte.

Here is the display field reference for ICMP.

Related Topic