Hello everyone, Wireshark is a nice product for analyzing LAN traffic. There seems to be a hole though in ICMPv6 sniffing implementation: I cannot see anywhere the ability to filter IPv6 Router Solicitation messages. asked 22 Mar '13, 08:08  actionmystique |
3 Answers:
When analyzing IPv6 traffic in Wireshark, you can simply use the filter When capturing, things get a little complicated. The BPF language is not yet updated to look into icmp6 headers. You can simply filter for icmp6 messages with the capture filter As long as there are no extension headers in the IPv6 header, you can use the filter ip6[40]=133 to capture only "Router Solicitation" messages. To add this functionality, you can better report this at http://www.tcpdump.org/, as the bpf filter engine is implemented in libpcap/winpcap. answered 22 Mar '13, 08:29  SYN-bit ♦♦ edited 22 Mar '13, 08:55 |
I presume you're meaning a capture filter and that there no icmpv6 equivalent of You can use a display filter though: icmpv6.type == 133 answered 22 Mar '13, 08:31  grahamb ♦ |
99 125.294551000 fe80::ffff:ffff:fffe ff02::2 ICMPv6 103 Router Solicitation 100 125.331293000 fe80::8000:f227:bec8:6189 fe80::ffff:ffff:fffe ICMPv6 151 Router Advertisement answered 09 Jun '13, 18:22  Chris222444 I'm not sure what this is an "answer" to? Wireshark can dissect ICMPv6, the original query was about capture filters for ICMPv6. (10 Jun '13, 03:10) grahamb ♦ |
Isn't the type for Router Solicitation 133? 135 is for Neighbor solicitation.
Thanks for your prompt answers.
The issue is that Router Solicitations don't even show up in the list of packets decoded by Wireshark.
I'm currently using Wireshark on a link between 2 routers in GNS3. One has an IPV6 statically configured address and is sending regular RA messages on the link. The other router has an interface configured with SLAAC, meaning it is waiting for a RA from the other router to auto-configure its IPv6 interface.
At bootup, I know the second router sends an RS to the first one since there's a 'debug ipv6 nd' on the latter. [I would like to upload a screenshot but apparently the permission is denied (errno 13)].
However no RS is shown in Wireshark, without any capture or display filter applied ...
OOPs, my mistake. There was an display filter applied.
However, icmpv6.type == 135 is Neighbor Solicitation, not Router Solicitation
icmpv6.type == 133 is correct.
Sorry!
Thanks @Grahamb, I corrected it :-)
It seems that 133 and 135 are easily confused today.