TShark & Multiple IP Addresses, (Mon, Feb 28th)

In diary entry “TShark & jq“, I mention that a single packet can have more than one ip.src entry.

I will illustrate this here. We are looking at a capture of network traffic where TCP SYN packets can not be delivered: “Destination unreachable”.

Here is the view with TShark:

Notice TCP packets going from to, and ICMP packets going from to

If we run a TShark command to extract all ip.src values, we get this:

For ICMP packets, we have 2 IPv4 addresses for the ip.src field: and

This is happening, because the ICMP packet embeds the IP packet to which it is replying. You can see this here in Wireshark:

The ICMP packet, encapsulated in an IP packet, has ip.src value of

But it also embeds the IP packet (with TCP) to which it is replying. That one has a src.ip value equal to

These are different fields, but both are accessed via ip.src and yield different values.


Didier Stevens
Senior handler
Microsoft MVP

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Reposted from SANS. View original.