Home / server / Questions / 893278
In Process
seladb
Asked: 2018-01-21 15:44:17 +0800 CST

Berkeley Packet Filter (BPF) syntax for IPv6 address

  • 772

I have a pcap file and I'm using a utility for manipulating its packets. This utility accepts Berkeley Packet Filter (BPF) filters to filter which packets to manipulate.

I'd like to manipulate only IPv6 packets with a certain dest or source address, for example: 2001:4f8:3:d::61 or 2607:f2c0:f00f:b001::face:b00c.

What is the right BPF filter to write here?

networking

1 Answers

  1. Have you tried ip6 net <your_ipv6_network_prefix>? https://www.tcpdump.org/manpages/pcap-filter.7.html

    True if the IPv4/v6 destination address of the packet has a network number of net. Net may be either a name from the networks database (/etc/networks, etc.) or a network number. An IPv4 network number can be written as a dotted quad (e.g., 192.168.1.0), dotted triple (e.g., 192.168.1), dotted pair (e.g, 172.16), or single number (e.g., 10); the netmask is 255.255.255.255 for a dotted quad (which means that it's really a host match), 255.255.255.0 for a dotted triple, 255.255.0.0 for a dotted pair, or 255.0.0.0 for a single number. An IPv6 network number must be written out fully; the netmask is ff:ff:ff:ff:ff:ff:ff:ff, so IPv6 "network" matches are really always host matches, and a network match requires a netmask length.

    • 0