I have a trace tracking one station pinging another, across multiple
days: 32,371 frames
10.1.2.3 10.1.2.4 ICMP Echo (ping) request
10.1.2.4 10.1.2.3 ICMP Echo (ping) reply
10.1.2.3 10.1.2.4 ICMP Echo (ping) request
10.1.2.4 10.1.2.3 ICMP Echo (ping) reply
[...]
Somewhere in there is one missing ICMP Echo Reply
I want to find precisely where (when) this occurs.
Can you think of a Wireshark way to accomplish this?
[If not, then I'll write a little code to walk through a text version of
the trace, looking for two back-to-back 'Echo (ping) request' lines ...
but I'm hoping for something slightly faster.]
--sk
