Wireshark Capture Filter - IPv4 and IPv6

3.3k views Asked by At

How would I specify a Wireshark capture filter to only capture ICMP (both for IPv4 and IPv6) and ARP and neighbour discovery protocol packets?

1

There are 1 answers

0
AudioBubble On BEST ANSWER

If by "neighbour discovery protocol" you mean the IPv6 Neighbor Discovery Protocol in RFC 4861, then it uses ICMPv6 packets, so "only capture ICMP (both for IPv4 and IPv6) and ARP and neighbour discovery protocol packets" is equivalent to "only capture ICMP (both for IPv4 and IPv6) and ARP packets".

The capture filter for that (for tcpdump, Wireshark, or any other program that uses libpcap for filtering) is icmp or icmp6 or arp.