tcpdump of ICMPv6 Router Advertisments

Problem Statement

You are in IPv6. Your hosts are not receiving the router advertisements that they ought to be receiving.  For example, you have several radvd daemons running on the local link.  You expect to see several address assignments.  You see some, but not enough.

Answer

tcpdump -i eth0 'ip6 && icmp6 && (ip6[40] = 134)'

and for all of the NDP type traffic

sudo tcpdump -i eth0 'ip6 && icmp6 && (ip6[40] == 133 || ip6[40] == 134 || ip6[40] == 135 || ip6[40] == 136)'

Wrong Answer

tcpdump -i eth0 'ip6 && icmp6 && (icmp6[icmptype] == 134)'

Result:

$ tcpdump -i eth0 'ip6 && icmp6 && (icmp6[icmptype] == 134)'
tcpdump: IPv6 upper-layer protocol is not supported by proto[x]
$ rpm -q tcpdump
tcpdump-4.1.1-1.fc14.x86_64

Also Relevant

Note tcpdump of ICMPv6 Destination Unreachable, Unreachable Address of 2012-12-17.

Background

From: Types of ICMPv6 messages

Type Code
Value Meaning Value Meaning
ICMPv6 Error Messages
133 Router Solicitation (NDP) 0
134 Router Advertisement (NDP) 0
135 Neighbor Solicitation (NDP) 0
136 Neighbor Advertisement (NDP) 0
137 Redirect Message (NDP) 0

References

Comments are closed.