Linux, FreeBSD, Juniper, Cisco / Network security articles and troubleshooting guides

Tcpdump icmp practical examples filtering on icmp type field and icmp code field

The manual for tcpdump shows how to use tcpdump expressions and primitives to build traffic capturing filters based on protocol field values, like specific icmp type and specific icmp code and specific source host.

Tcpdump also offers a way to filter packets with specified value in a specific protocol byte number, ie: we know icmp header first byte (0) is icmp type and second byte (1) is the icmp code so tcpdump allows to either use builtin primitives like "icmptype" and "icmpcode" or protocol byte number like "icmp[0]" and "icmp[1]".


Per RFC792 (https://tools.ietf.org/html/rfc792 below is icmp protocol header:




Wikipedia page for icmp shows the full table of icmp types and icmp codes as well as their numerical codes: http://en.wikipedia.org/wiki/Internet_Control_Message_Protocol.

Manual for tcpdumps shows us a list of available builtin primitives for icmp types and codes. Quote:

Example based on the same manual:To print all icmp packets that are not ping packets (echo requests/replies):

or printing icmp packets that are not ping by using byte numbers and numerical codes for icmp type and icmp code:

Tcpdump print only icmp traffic:

Tcpdump print only "Destination Unreachable" icmp type, "Fragmentation required and DF bit set" icmp code