Wireshark · Ethereal-users: [Ethereal-users] ICMP

[Bob Snyder <bob.snyder@xxxxxxx>]

Why are ICMP packets displayed when a display filter is used that should 
exclude them?

For example, when running a traceroute, and with a display filter of 
"udp", in addition to the outbound UDP datagrams, the ICMP messages 
returned from each router are displayed as well. I know that the ICMP 
datagrams include the headers of the datagrams that are being reported 
on, but apparently their presence allows them to pass through the 
display filter. Is this behavior intentional? If so, what is the rationale?

Bob Snyder