This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I have recently upgraded from 1.10.3 to 1.12.4 and found that running the command tshark -q -r input.cap -z ip_hosts,tree does NOT include any IPv6 addresses even though they exist in the capture file.

Is there an equivalent command for IPv6 or is this a bug?

asked 15 Jul '15, 17:05

matt's gravatar image

matt
6112
accept rate: 0%


ip_hosts is an filter for the "ip" tap (internal thing), which is fed by packet-ip IP(v4) protocol dissector. The packet-ipv6 IPv6 dissector feeds the ipv6 tap (again the internal mechanism for statistics etc.) which does not have a corresponding statistics output filter AFAIK.

In short 'ip' is usually an abbreviation of ipv4 and (unfortunately maybe) not the aggregate of both protocols (although by itself is not strange, because of the sometimes significant differences between them)

permanent link

answered 16 Jul '15, 05:40

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×832
×51
×23
×1

question asked: 15 Jul '15, 17:05

question was seen: 1,609 times

last updated: 16 Jul '15, 05:40

p​o​w​e​r​e​d by O​S​Q​A