If you want to filter ICMP echo-requests with tcpdump, you can use this command:
tcpdump -i em0 "icmp[0] == 8"
But it doesn’t work if you try the same syntax with ICMPv6:
tcpdump -i em0 "icmp6[0] == 128" tcpdump: IPv6 upper-layer protocol is not supported by proto[x]
Instead you can parse directly the IPv6 payload. An IPv6 packet is 40 bytes long, and the first 8 bits of the ICMPv6 header specify its type:
tcpdump -i eth0 "icmp6 && ip6[40] == 128"
The most common ICMPv6 types are:
- unreachable: 1
- too-big: 2
- time-exceeded: 3
- echo-request: 128
- echo-reply: 129
- router-solicitation: 133
- router-advertisement: 134
- neighbor-solicitation: 135
- neighbor-advertisement: 136