ICMP Raw Payload Expressions

[Sunny73Cr <Sunny73Cr@xxxxxxxxxxxxxx>]

Hi,

Packet structure of ICMP-DU (Destination Unreachable) (in my case) is Eth,IP4,ICMP,ICMP-DU

It is my understanding that Eth is ll, IP4 is nh, ICMP is th, and ICMP-DU is ih.

If I am to match the ICMP header, is `th` the correct offset?

If I am to match the ICMP-DU content, is `ih` the correct offset?

Thanks,
sunny