expression rejects all packets for IPv6 upper-layer protocol

[yiyuandao]

Hi,

I tried to run following command:

tcpdump -i em1 'ip6 and udp[10]&1 !=0' 

and got the following:

tcpdump: expression rejects all packets

I checked the document pcap-filter.
and in the section 'expr relop expr':

Note that tcp,
udp and other upper-layer protocol types only apply to IPv4, not
IPv6 (this will be fixed in the future)

I wonder is there any plan to add this filter for IPv6?

Thanks.

[agnosticdev]

@yiyuandao wanted to follow up on your filtering question for IPv6; You could try using running your UDP filter wide open and then using grep to capture everything coming across as IP6.

tcpdump -i em1 udp and 'udp[10] & 1!=0' -vvv | grep -i 'IP6'

[KimiNewt]

This issue still exists (in tcp/udp). Is there a reason the syntax ought not to work? Since something like ip6 and tcp port 80 works fine.

If we do want syntax like ip6 and tcp[1] = 0x5 to work, do we want only tcp[1] = 0x5 to look for IPv6 in addition to IPv4? Or leave it as only IPv4?
tcp port 80 Checks for both so there is a little inconsistency.

What is the desired behaviour? I was thinking of making a PR with these changes but I'm not sure what would be preferred.

[infrastation]

As the pcap-filter(7) man page explains it:

To access data inside the packet, use the following syntax:
proto [ expr : size ]
Note that tcp, udp and other upper-layer protocol types only apply to IPv4, not IPv6 (this will be fixed in the future).

[infrastation]

Closing as resolved (not a bug, but an improvement that remains to be made).

[bubbasnmp]

Should this issue be left open to track it as an enhancement request?

[infrastation]

Alright, let's keep it reopened for a while longer.