Wireshark-users: Re: [Wireshark-users] message about "ipv6 not supported"
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 16 Sep 2008 18:25:22 -0700

On Sep 16, 2008, at 6:01 PM, Rachel McConnell wrote:

I've been using WIreshark for some time in a very limited manner, to
check the content & headers of web sites I develop.  Lately I've
encountered a need to filter for ipv6 addresses.  According to
http://www.wireshark.org/docs/man-pages/wireshark.html, Wireshark
supports ipv6 addresses.  I'm having trouble finding docs that seem
authoratative on the syntax of the capture or display filters but for
a capture filter I read that simply "ip6" should work.

It should work *if* the version of libpcap on the system you're using supports IPv6.

On my
installation I get this error:

That string isn't a valid capture filter (ip6 not supported).
See the User's Guide for a description of the capture filter syntax.

For a display filter, I get a happy green background on "ipv6 eq

"Green" means "syntactically valid", not "does what you want". :-)

The expression that should do what you want is

	ipv6.addr eq fe80::216:cbff:fe96:b18a

I.e., you want to check whether a packet has an IPv6 source or destination address of fe80::216:cbff:fe96:b18a; "ipv6" doesn't stand for an IPv6 address, it stands for the entire IPv6 protocol (and I'm not even sure what comparing "ipv6" to something should mean, unless it's comparing the entire IPv6 header against the specified string).

Running on Darwin 8.11.1 (MacOS 10.4.11), with libpcap version 0.9.8.

Are you using the libpcap that comes with Tiger, or did you build your own version of libpcap? I think the version that comes with Tiger supports IPv6; try the command "tcpdump -d ip6" and see what it prints.