In Wireshark, if I want to write a filter which accepts only ICMP destination unreachable ( type 3 ) messages, the filter is icmp[0] == 3
.
How do I count the packet offset of 0 in this instance ?
EDIT
Based on the above image from Wikipedia, the ICMP type is under 0-7 bits. Therefore it is the first byte and therefore 0 ?
Best Answer
Your filter is correct,
icmp[0]
indeed matches the first byte of the ICMP header containing the type. However, I find it hard to read, you should useicmp.type eq 3
instead. This is also much easier when the field is longer than one byte.Here is the display field reference for ICMP.