Wireshark · Ethereal-users: Re: [Ethereal-users] Re: ICMP

[Jack Jackson <jack@xxxxxxxxxxxxxxx>]

At 04:06 PM 3/21/2005, James Knott wrote:
> ronnie sahlberg wrote:
> > That is what is supposed to happen.
> > Rationale:
> > You asked for all packets containing the UDP protocol and you got them.
> > An analyzer that filtered for UDP and did not show you these pacekts
> > to you would be broken. Ethereal is not broken in this regard.
>
> ICMP is not UDP.  Why should Ethereal show something that's not selected?

Because there is a UDP message inside the ICMP message.

The best reason I can think of for it working this way is:  Suppose you are 
capturing a UDP conversation.  If at some point a UDP message gets returned 
via ICMP because of some error, you probably want to see that.