Filter ICMP packets sent from my IP address in Wireshark with the Packet Filter

Question

I want to filter the ICMP packets sent from my IP address in Wireshark.

I tried the following expression:

ip.src == xxx.xxx.xxx.xxx && icmp

But the problem is that it shows packets with ip.src = yyy.yyy.yyy.yyy
that were sent to ip.dst = xxx.xxx.xxx.xxx.

Solution

The problem is that ICMP type 11 (TTL expired) returns the IP header of the sent IP packet. So in order to fix it, we need to exclude the type 11 ICMP. 0b = 11 in decimal, so use this filter to fix it:

ip.src == xxx.xxx.xxx.xxx && !(icmp[0] == B ) && icmp

Comments

[0xab3d]

0b = 11 in decimal so we want to exclude the type 11 ICMP