Wireshark-users: Re: [Wireshark-users] ICMP Echo Requests & Replies - multiple Identifier & Seque
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 24 Feb 2011 10:14:28 -0800
On Feb 24, 2011, at 3:30 AM, Keith French wrote:

> I have recently seen in Wireshark when looking at an echo request/reply pair, that instead of the identification/sequence numbers used to tie the two packets together, there are now two identifiers and two sequence numbers:-

...or, as others have indicated, one identifier, presented two ways, and one sequence number, presented two ways.

> & how do you use them to tie up the request & reply?

Look either for matching little-endian values or matching big-endian values.