// ICMP echo packet

INCLUDE
   
PARAMETERS: <name of file>
Starts processing the content of given file. The search of file will be performed in the current directory, all search paths (see option -I). For every path the content of samples, headers, traces folders will be also examined. You can also type just the name of file without INCLUDE
   
PARAMETERS: <name of file>
Starts processing the content of given file. The search of file will be performed in the current directory, all search paths (see option -I). For every path the content of samples, headers, traces folders will be also examined. You can also type just the name of file without INCLUDE
   
PARAMETERS: <name of file>
Starts processing the content of given file. The search of file will be performed in the current directory, all search paths (see option -I). For every path the content of samples, headers, traces folders will be also examined. You can also type just the name of file without include before it.

 before it.

 before it.

 icmp

// FIELDS FOR ECHO MESSAGES (unused field)
POS
   
PARAMETERS: <new position> | <field's name>
Sets the <new position> of byte pointer. In the case of <field's name> new position will be equal to field's position.

 icmp.unused
// ECHO id
.icmp.id         4500s2.
// ECHO sequence number
.icmp.num        1000s2.
// ECHO data
.icmp.data       
''

CLEARMASK
   
PARAMETERS: no parameters
The mask of packet (the set of previously defined conditions) will be cleared. New mask will correspond to any packet. This command is usually contained in headers to make the mask correspond to all packets of given type (ex: TCP packets).



ethproto = ip
ip.proto = icmp    
// packet's mask will contain only this conditions

//  ATTENTION: mask defines any icmp packet but not only echo

POS
   
PARAMETERS: <new position> | <field's name>
Sets the <new position> of byte pointer. In the case of <field's name> new position will be equal to field's position.

 icmp.data