Wireshark · Wireshark-users: [Wireshark-users] ICMP packets with two pairs of source and destination ip addresses?

Wireshark-users: [Wireshark-users] ICMP packets with two pairs of source and destination ip addre

From: nangergong <nangergong@xxxxxxxxx>

Date: Wed, 6 Jun 2012 12:20:01 +0200

HI, all,

     I used tshark to parse a pcap file with icmp packets,
                  tshark -r icmp -T fields -e frame.number -e ip.src -e ip.dst

     and the results are something like this:

1    74.125.132.188    138.96.192.56
2    74.125.132.188    138.96.192.56
3    138.96.192.56,74.125.132.188    74.125.132.188,138.96.192.56
4    138.96.192.56,74.125.132.188    74.125.132.188,138.96.192.56
5    74.125.132.188    138.96.192.56
6    138.96.192.56,74.125.132.188    74.125.132.188,138.96.192.56
7    74.125.132.188    138.96.192.56
8    138.96.192.56,74.125.132.188    74.125.132.188,138.96.192.56
9    74.125.132.188    138.96.192.56
10    138.96.192.56,74.125.132.188    74.125.132.188,138.96.192.56
11    74.125.132.188    138.96.192.56
12    138.96.192.56,74.125.132.188    74.125.132.188,138.96.192.56

so , like 3, 4, 6,8,10,12 , there are two src ip addr and dst ip addr
what is the reason for this? thanks

Follow-Ups:
- Re: [Wireshark-users] ICMP packets with two pairs of source and destination ip addresses?
  - From: ronnie sahlberg

Prev by Date: Re: [Wireshark-users] Reading a zero-terminated string in Lua dissector
Next by Date: Re: [Wireshark-users] ICMP packets with two pairs of source and destination ip addresses?
Previous by thread: Re: [Wireshark-users] how to show protocol with tshark
Next by thread: Re: [Wireshark-users] ICMP packets with two pairs of source and destination ip addresses?
Index(es):
- Date
- Thread