Ask Your Question

Beginner: Display Filter to Detect Ping

asked 2020-04-15 21:32:03 +0000

Buadhai gravatar image

updated 2020-04-17 06:34:45 +0000

Jaap gravatar image

Wireshark 3.2.3, iMac 2017, MacOS 10.12.4

I'm trying to figure out why the "LAN Control" on a Yeelight "smart lightbulb" stopped working. You can control the bulb by sending UDP messages at port 55443. This was working fine for me for a while and then stopped. A friend suggested using Wireshark to check network traffic. I've found it to be a steep learning curve.

When I use a filter with the IP address of the device (ip==, Wireshark detects no traffic at all even when I send a formerly working message via UDP. OK, something wrong.

But even when I ping the device Wireshark shows nothing at that IP address:

MyMachine:~ mnewman$ ping -c 3
PING ( 56 data bytes
64 bytes from icmp_seq=0 ttl=255 time=133.614 ms
64 bytes from icmp_seq=1 ttl=255 time=3.227 ms
64 bytes from icmp_seq=2 ttl=255 time=4.719 ms

--- ping statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 3.227/47.187/133.614/61.116 ms

What am I doing wrong?

edit retag flag offensive close merge delete


Was your filter set to (ip== or (ip.addr== ?

Chuckc gravatar imageChuckc ( 2020-04-15 22:21:29 +0000 )edit

Are you capturing traffic on the correct interface? You may want to temporarily remove the capture filter to be sure you're capturing any traffic at all. You may also want to try capturing with another tool, such as tcpdump, to see if your results are any different.

cmaynard gravatar imagecmaynard ( 2020-04-15 22:24:19 +0000 )edit

Filter was (ip== What should I use to detect pings sent to that IP address?

Which interface should I use? I have both Ethernet and WiF enabledi (en0 and en1). If I ping from a terminal session, which interface does it use?

Buadhai gravatar imageBuadhai ( 2020-04-15 22:34:22 +0000 )edit

Comparing a protocol (ip) to IP address returns no results but is legal syntax.

/mnt/c/Program Files/Wireshark$ dftest.exe "(ip=="
Filter: "(ip=="

00000 PUT_FVALUE        31:39:32:2e:31:36:38:2e:30:2e:32:30:30 <FT_PROTOCOL> -> reg#1

00000 READ_TREE         ip -> reg#0
00001 IF-FALSE-GOTO     3
00002 ANY_EQ            reg#0 == reg#1
00003 RETURN
Chuckc gravatar imageChuckc ( 2020-04-15 23:51:39 +0000 )edit

Well, I don't really understand networking at all. Pretty tough when you have to learn so many new terms and concepts to just diagnose a single problem. But, I appreciate the explanation and the help.

Buadhai gravatar imageBuadhai ( 2020-04-15 23:55:50 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted

answered 2020-04-15 22:53:26 +0000

Chuckc gravatar image

updated 2020-04-15 22:54:01 +0000

Display filter: ip.addr==
Capture filter: host

edit flag offensive delete link more


Thank you. I can now see that the message has been sent to the device:


So, apparently not a network problem.

I appreciate the help.

Buadhai gravatar imageBuadhai ( 2020-04-15 23:46:22 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2020-04-15 21:32:03 +0000

Seen: 2,859 times

Last updated: Apr 17 '20