{"id":1053,"date":"2016-09-09T14:43:26","date_gmt":"2016-09-09T12:43:26","guid":{"rendered":"http:\/\/www.hauweele.net\/~gawen\/blog\/?p=1053"},"modified":"2016-09-09T14:43:26","modified_gmt":"2016-09-09T12:43:26","slug":"filter-icmpv6-with-tcpdump","status":"publish","type":"post","link":"https:\/\/hauweele.net\/~gawen\/blog\/?p=1053","title":{"rendered":"Filter ICMPv6 with tcpdump"},"content":{"rendered":"<p>If you want to filter ICMP echo-requests with tcpdump, you can use this command:<\/p>\n<pre>tcpdump -i em0 \"icmp[0] == 8\"\r\n<\/pre>\n<p>But it doesn&#8217;t work if you try the same syntax with ICMPv6:<\/p>\n<pre>tcpdump -i em0 \"icmp6[0] == 128\"\r\ntcpdump: IPv6 upper-layer protocol is not supported by proto[x]\r\n<\/pre>\n<p>Instead you can parse directly the IPv6 payload. An IPv6 packet is 40 bytes long, and the first 8 bits of the ICMPv6 header specify its type:<\/p>\n<pre>tcpdump -i eth0 \"icmp6 &amp;&amp; ip6[40] == 128\"\r\n<\/pre>\n<p>The most common <a href=\"http:\/\/en.wikipedia.org\/wiki\/Internet_Control_Message_Protocol_version_6\">ICMPv6 types<\/a> are:<\/p>\n<ul>\n<li><strong>unreachable<\/strong>: 1<\/li>\n<li><strong>too-big<\/strong>: 2<\/li>\n<li><strong>time-exceeded<\/strong>: 3<\/li>\n<li><strong>echo-request<\/strong>: 128<\/li>\n<li><strong>echo-reply<\/strong>: 129<\/li>\n<li><strong>router-solicitation<\/strong>: 133<\/li>\n<li><strong>router-advertisement<\/strong>: 134<\/li>\n<li><strong>neighbor-solicitation<\/strong>: 135<\/li>\n<li><strong>neighbor-advertisement<\/strong>: 136<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>If you want to filter ICMP echo-requests with tcpdump, you can use this command: tcpdump -i em0 &#8220;icmp[0] == 8&#8221; But it doesn&#8217;t work if you try the same syntax with ICMPv6: tcpdump -i em0 &#8220;icmp6[0] == 128&#8221; tcpdump: IPv6 &hellip; <a href=\"https:\/\/hauweele.net\/~gawen\/blog\/?p=1053\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[738,737,736,733,732,731,735,164,744,743,742,741,734,739,740],"class_list":["post-1053","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-echo-reply","tag-echo-request","tag-filter","tag-icmp","tag-icmp6","tag-icmpv6","tag-ip6","tag-ipv6","tag-neighbor-advertisement","tag-neighbor-solicitation","tag-router-advertisement","tag-router-solicitation","tag-tcpdump","tag-too-big","tag-unreachable"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/hauweele.net\/~gawen\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1053","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hauweele.net\/~gawen\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hauweele.net\/~gawen\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hauweele.net\/~gawen\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/hauweele.net\/~gawen\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1053"}],"version-history":[{"count":0,"href":"https:\/\/hauweele.net\/~gawen\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1053\/revisions"}],"wp:attachment":[{"href":"https:\/\/hauweele.net\/~gawen\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1053"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hauweele.net\/~gawen\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1053"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hauweele.net\/~gawen\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1053"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}