Wireshark · Ethereal-users: Re: [Ethereal-users] tethereal for selective capture

[Guy Harris <guy@xxxxxxxxxx>]

> I wanted to capture coordinated traceroutes actually using Ethereal.
> If I can pick up two ICMP messages withing say 5 seconds ,it would be a 
> great help. And yes ,ICMP Echo requests would be fine . How can I use 
> tethereal to capture these kind of packets ?

	tethereal -i <interface> -w <file to write the capture to> icmp

will capture all ICMP packets and only ICMP packets (assuming they're
not tunneled, or otherwise encapsulated so that the IP header that comes
right after the link-layer headers doesn't say they're ICMP packets; it
might not also handle VLANs).

Selecting particular *types* of ICMP packets is left as an exercise to
the reader, *if* there's so much ICMP traffic on the network that
capturing only Echo packets is worthwhile.