Why can't Wireshark read packets from ping?

Question

I have Wireshark started, then I ping an IP address.

But Wireshark is not picking up any packet sending to or receiving (echoing) from the destination address.

Why? Is ping "protected" from being sniffed?

Solution 1

Make sure you aren't filtering the results
- ensure wireshark is capturing and displaying everything not just IP or TCP (ICMP is a different protocol - Ensure you are looking at the correct network interface

Solution 2

I've bumped into the same problem and what worked for me was filtering the IP address using:

arp.dst.proto_ipv4 == {My.Dst.IP.Address}

instead of:

ip.addr == {My.Dst.IP.Address}

and then I could see the ARP messages even though I couldn't see the IP messages.

Comments

[user1686]

You probably just started Wireshark on the wrong network interface.

[m0skit0]

It's not. Wireshark sniffs ICMP. You're doing something wrong, but we cannot guess if you give no details.

[whitequark]

If you have started Wireshark on all network interfaces and this is Windows, then AFAIK you won't be able to capture any traffic (incl. pings) on loopback interface (127.0.0.1/8) due to the way Windows network stack works.

[Stack Player]

how can we check if we are filtering anything like ipv4 or ICMP (with the display filter being cleared)?

[Admin]

This worked for me as well. My interface was sending out ARP requests trying to figure out how to route to the destination but wasn't receiving a reply.