Wireshark · Ethereal-users: Re: [Ethereal-users] Re: ICMP

[Olaf van der Spek <olafvdspek@xxxxxxxxx>]

On Mon, 21 Mar 2005 20:25:22 -0800, Bob Snyder <bob.snyder@xxxxxxx> wrote:
> I disagree with the notion that when filtering for UDP, if it didn't
> display ICMP packets that come back, Ethereal would be broken. The
> headers inside the ICMP message are effectively it's payload - it's
> still an ICMP packet, not UDP (or whatever). The frame does not contain
> UDP datagrams (or whatever other protocol caused the ICMP message). And

But why would the filter (only) apply to the frame layer and not to
another layer?
Sure, UDP on top of IP is the most common variant, but why should it
be the only variant the filter matches?

> it's presumptuous of the program (dare I say the devs?) to presume that
> you must surely want to see the ICMP messages when what your display
> filter asks for is only the original message packets.

You didn't ask for 'udp directly on top of ip', but just for udp.