This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi,

I have a PCAP-file which contains multiple frames with Ip4 Header with as info "IPv6 Hop-by-Hop Option" (see screenshot below)

My question is:

  • What kind of packets are this?
  • In what situations you will see them in traffic?
  • How can I filter on these Hop-by-Hop packets? (e.g. as display filter in Wireshark, or via code in via libpcap). As far as I can see source/dest are 0.0.0.0. Is this always the case for this class of packets?

Thanks

alt text

asked 03 Feb '16, 05:45

Jos's gravatar image

Jos
6225
accept rate: 0%


That packet looks bogus all the way - It has source and destination IP zero, which is impossible on a live network, so it looks like someone messed with (=edited) the packet.

IPv6 Hop-by-Hop isn't relevant to IPv4 packets, either.

permanent link

answered 03 Feb '16, 05:52

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

edited 03 Feb '16, 05:54

Or a device 'lost its marbles' and produced this frame on its network interface...

(03 Feb '16, 08:37) Jaap ♦

"IPv6 Hop-by-Hop" is the protocol that's defined by IANA for IP protocol number 0.

To filter, use a display filter of ip.proto == 0.

permanent link

answered 03 Feb '16, 05:53

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×51

question asked: 03 Feb '16, 05:45

question was seen: 4,346 times

last updated: 03 Feb '16, 08:37

p​o​w​e​r​e​d by O​S​Q​A