Capturing IPV6 packets with tcpdump and ethereal

Tcpdump and ethereal are well-known open-source network packet capture and analysis software, everyone has been used, where ethereal is captured filter set capture rules, display filter settings show the rules, The syntax for capturing rules and display rules is different, where the catch rule syntax is similar to the regular rule syntax of tcpdump. Here is a brief description of how to set the filter in Tcpdump and ethereal to capture IPV6 packets.

1. Host-based capture
Host host #host可以是主机名或IP地址
SRC Host host #host作为数据包的源地址
DST Host host #host作为数据包的目的地址

$tcpdump-T-vv-n-I eth0-s-host 1337::1

2. Based on port number
Port port #捕获端口号为80的数据包 Regardless of source or destination
SRC Port Port #源端口80
DST Port Port #目的端口80

3. Network segment based
NET 192.168
SRC Net 192.168
DST Net 192.168

4. Protocol-based
Ether Proto
IP Proto TCP
Tcp
Udp
IP Proto UDP

5. Byte-based offsets
Syntax: Proto[offset]
IP[8]: TTL field
IP[9]: Protocol field in IP header

Therefore, to capture IPV6 packets, you can set the following simple filtering rules:
1) Proto IPv6
$tcpdump-T-vv-n-i eth0-s Proto IPv6
2) ether Proto 0X86DD

Capture the IPV6 tunnel packets encapsulated in IPV4:
Ip[9]=41