Tcpdump Filter ICMPv6 Packets

To filter ICMPv6 packets with tcpdump, use the expression icmp6 or ip6 protochain 58. This captures all ICMPv6 traffic on the interface, which includes neighbor discovery, router advertisements, and echo requests/replies.

What Is ICMPv6 and Why Filter It?

ICMPv6 (Internet Control Message Protocol version 6) is the IPv6 counterpart to ICMPv4. It handles error reporting, path MTU discovery, and the essential neighbor discovery protocol (NDP) that replaces ARP in IPv6. Because IPv6 hosts rely on ICMPv6 for address resolution and router discovery, this traffic is constant on any IPv6-enabled network. Filtering it lets you isolate these control messages from data traffic when troubleshooting connectivity, duplicate address detection, or router advertisement issues.

Basic Filter Syntax

The simplest filter is just icmp6:

sudo tcpdump -i eth0 icmp6

This shows all ICMPv6 packets. If you need to be explicit, use the protocol number:

sudo tcpdump -i eth0 ip6 proto 58

Both work identically. The icmp6 keyword is a shorthand that tcpdump understands natively.

Filtering by ICMPv6 Type

ICMPv6 messages are identified by a type field. You can filter on that with icmp6[icmp6type]. Common types include:

• 128 – Echo Request (ping)
• 129 – Echo Reply
• 133 – Router Solicitation
• 134 – Router Advertisement
• 135 – Neighbor Solicitation
• 136 – Neighbor Advertisement

To capture only pings, use:

sudo tcpdump -i eth0 icmp6[icmp6type] = 128

Or for both requests and replies:

sudo tcpdump -i eth0 'icmp6[icmp6type] = 128 or icmp6[icmp6type] = 129'

Note the single quotes to protect the expression from shell interpretation.

Filtering by Source or Destination

Combine ICMPv6 with host or network filters to narrow results:

sudo tcpdump -i eth0 icmp6 and host fe80::1

This shows ICMPv6 traffic to or from the link-local address fe80::1. To see only neighbor discovery from a specific host:

sudo tcpdump -i eth0 'icmp6[icmp6type] = 135 and src fe80::1'

Common Pitfalls and Misconceptions

A frequent mistake is using icmp instead of icmp6. The icmp keyword only matches IPv4 ICMP. On a dual-stack interface, you must use both if you want both versions:

sudo tcpdump -i eth0 'icmp or icmp6'

Another gotcha: some tcpdump versions (older than 4.x) may not accept icmp6type. In that case, use the raw byte offset: icmp6[0] = 128. Also, remember that ICMPv6 includes neighbor discovery messages that are not errors. If you see a flood of neighbor solicitations, it may indicate duplicate address detection or a misconfigured host, not an attack.

Reading the Output

When you capture, tcpdump prints a line per packet. For example:

12:03:44.123456 IP6 fe80::1 > ff02::1: ICMP6, router advertisement, length 64

The fields show timestamp, source, destination, message type, and length. For neighbor solicitation, you’ll see the target address. This output helps identify which device is sending unsolicited advertisements or responding to pings.

Advanced Filtering with Byte Offsets

If you need to filter on the ICMPv6 code or specific fields like the MTU in a packet-too-big message, use raw byte offsets. The ICMPv6 header starts after the IPv6 header, which is 40 bytes. So icmp6[4] is the code field. For example, to capture only packet-too-big messages (type 2):

sudo tcpdump -i eth0 'icmp6[0] = 2'

To filter on the MTU value (bytes 6-7 of the ICMPv6 header), you’d need to combine offsets, which is rarely necessary. Most users stick to type filtering.

Frequently Asked Questions

Why don’t I see any ICMPv6 packets when I run tcpdump?

Your interface may not have IPv6 enabled, or the traffic is on a different interface. Check with ip -6 addr to see if you have a link-local address. Also, some cloud providers disable ICMPv6 by default.

How do I capture only echo requests (ping) with tcpdump?

Use tcpdump -i eth0 icmp6[icmp6type] = 128. If your tcpdump doesn’t support icmp6type, use icmp6[0] = 128.

What is the difference between icmp6 and ip6 proto 58?

None. Both match the same packets. icmp6 is a shorthand for ip6 proto 58.

Can I filter ICMPv6 by MAC address?

Yes, use ether host combined with icmp6: tcpdump -i eth0 'icmp6 and ether host 00:11:22:33:44:55'. This works because tcpdump can filter on the Ethernet header before the IP header.

Does tcpdump show ICMPv6 neighbor discovery by default?

Yes, if you use icmp6 without type restrictions, it shows all ICMPv6, including NDP messages. To exclude them, filter for types 128-129 only.

How do I save ICMPv6 captures to a file?

Use the -w flag: sudo tcpdump -i eth0 icmp6 -w icmpv6.pcap. Then open with Wireshark or read with tcpdump -r icmpv6.pcap.

Related

• Language Detection Caching & Rate Limits Guide
• How to Exit Twitch on Desktop
• Scaling Telecom Manufacturing: Assembly to R&D