I think tcpdump would have been much simpler. If ...

2008-07-22T09:12:00.000-05:00

I think tcpdump would have been much simpler. If you are looking for *any* icmp packets, you can simply use:

tcpdump -xttttn -i [interface] icmp

and that will spit out all icmp packets.

If you want packets with a particular code you can do that as well:

tcpdump -xttttn -i [interface] icmp[1] == 3

This spits out all icmp packets that are destination unreachable.

tcpdump -xttttn -i [interface] icmp[1] == 0

This spits out all icmp echo reply packets (when you ping something).

icmp[1] means look at the 2nd byte, which is where the codes are stored.

Hope this helps.

Comments on What Would You Say It Is You Do Here?: Viewing Multiple Capture Files With tcpdump

I think tcpdump would have been much simpler. If ...