Re: Libpcap: BPF filter for ipv6 tunnel

[Guy Harris <guy () alum mit edu>]

On Jul 31, 2011, at 4:26 PM, ramkumar.paranandi () gmail com wrote:

> I have smtp traffic over ipv6 tunneled in  ipv4.   .ip->ipv6->tcp->smtp
> How can we set bpf to filter smtp in ipv6 in ipv4 tunnel traffic? I have tried with ip protochain 0x06 it is not 
> working.

"ip protochain" doesn't support "shifting gears" from IPv4 to IPv6; it only supports AH. 

There is, unfortunately, currently no way to ask for the type of filtering you need - libpcap doesn't know about IP 
protocol 41 (which I assume is what's being used here).  Time permitting, I'll look at implementing something.-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.