The `omping` command invocations are explained in our documentation.
For the tcpdump, I'd do something like
`tcpdump -s0 -w corosyncproblem.pcap -ni $IFACE`, where `$IFACE` is replaced by the interface your corosync network is bound on.
after gathering enough data (the log saying that the ring became faulty and ok again) - stop tcpdump with Ctrl-C, take the resulting corosyncproblem.pcap and open it in wireshark.