Wireshark-users: Re: [Wireshark-users] Computing ICMP Statistics in Wireshark

From: Hansang Bae <for_list_hbae@xxxxxxxxxx>
Date: Tue, 04 Aug 2009 00:50:39 -0400

vyaaghrah-wire@xxxxxxxxx wrote:

Just simply computing number of request send v/s number of replies received and correlating the if their is percentage loss in the same

If it's a one time thing, you could look at the display packet stats at the bottom.

Use a display filter of 'icmp.type==8" to look for PING requests.
Then look at how many packets match the display filter at the bottom

e.g.  packets 385  Displayed 100

Then use 'icmp.type=0' to look for replies.

If you don't have 100, you lost some.  is this what you were looking for?

I suppose you can use TSHARK and some awk scripts if you need to do this over and over.

--

Thanks,
Hansang