Wireshark · Ethereal-users: Re: [Ethereal-users] how to dissect packets in mobile ipv6?

[Guy Harris <gharris@xxxxxxxxx>]

On Mon, Aug 05, 2002 at 02:10:15PM +0800, Huang Qian wrote:
> I captured the RTP packets in Mobile IPv6 environment with ethereal, i.e.
> the mobile node handover between the home network and foreign network during
> the capturing process. I know ethereal calls the libpcap to capture those
> packets, I wonder whether the handover will influnce the libpcap, for
> example, if i only use the correspondent node's address ( which won't be
> changed during the handover) as the filter, will ethereal on mobile node
> capture all the packets send from the CN, no matter how MN moves ? If so,
> whether pcap on MN knows its address has been changed?

No, libpcap does not.  The only place where libpcap knows anything at
all about network addresses is in capture filters, and a capture filter
is converted to "machine code" for the BPF interpreter when it's
compiled, and the numerical values of those addresses are wired into the
machine code - they do not change over time.

So if you use a capture filter that specifies the host name or the IPv6
address of the mobile node at the time that you start capturing, so that
only packets to or from the address that host name resolves to, or the
specified IPv6 address, are captured, it will *NOT* capture packets to
or from the mobile node if its IP address changes.