Re: [tcpdump-workers] Warning on enabling ip6 protochain 6

2011-08-09 Thread ramkumar . paranandi
"Ip6 protochain 6 and tcp port 25 and net 10.1.1.0 " would filter packets ipv6 with extension hdrs and tcp port 25 and which belongs to network 10.1.1.0? Can we use other filters along with ip6 protochain? Thanks, ./ram On Aug 9, 2011, at 12:39 AM, Guy Harris wrote: > > On Aug 8, 2011, at 1

Re: [tcpdump-workers] Warning on enabling ip6 protochain 6

2011-08-09 Thread Darren Reed
On 6/08/11 11:22 PM, Guy Harris wrote: On Aug 5, 2011, at 6:59 AM, Darren Reed wrote: On 5/08/11 01:46 AM, Guy Harris wrote: ... That could, in theory, be fixed - for example, BSD/OS's BPF interpreter had an instruction that would do IPv6 extension header parsing How muc

Re: [tcpdump-workers] Warning on enabling ip6 protochain 6

2011-08-09 Thread Guy Harris
On Aug 8, 2011, at 10:56 PM, ramkumar.parana...@gmail.com wrote: > How much percentage of traffic in real world scenarios would these kind > (ipv6 chain)of packets consist? It depends on the scenario. If 50% of the traffic on your network is TCP-over-IPv6 traffic, then 50%. :-) Or, to put i

Re: [tcpdump-workers] Warning on enabling ip6 protochain 6

2011-08-08 Thread ramkumar . paranandi
How much percentage of traffic in real world scenarios would these kind (ipv6 chain)of packets consist? Thanks, ./ram On Aug 8, 2011, at 7:44 PM, Guy Harris wrote: > > On Aug 8, 2011, at 6:22 PM, ramkumar.parana...@gmail.com wrote: > >> Can we expect any packet drop by the kernel due to th

Re: [tcpdump-workers] Warning on enabling ip6 protochain 6

2011-08-08 Thread Guy Harris
On Aug 8, 2011, at 6:22 PM, ramkumar.parana...@gmail.com wrote: > Can we expect any packet drop by the kernel due to this warning? If a lot of the traffic on your network isn't TCP, so that a lot of traffic would've been discarded by the filter if it could've been run in the kernel, more traff

Re: [tcpdump-workers] Warning on enabling ip6 protochain 6

2011-08-08 Thread ramkumar . paranandi
Hi, Can we expect any packet drop by the kernel due to this warning? If so, what kind of packets would kernel drop? Thanks, ./ram On Aug 8, 2011, at 4:24 AM, Darren Reed wrote: > On 6/08/11 11:22 PM, Guy Harris wrote: >> ... >> For "ip4 protochain", the only protocol type that needs special

Re: [tcpdump-workers] Warning on enabling ip6 protochain 6

2011-08-08 Thread Darren Reed
On 6/08/11 11:22 PM, Guy Harris wrote: ... For "ip4 protochain", the only protocol type that needs special treatment is AH; can there be AH-within-AH? If so, that'd need a different instruction, otherwise, unless I'm missing something, there's no need for a loop. There's IP in IP (proto #4)

Re: [tcpdump-workers] Warning on enabling ip6 protochain 6

2011-08-06 Thread Guy Harris
On Aug 5, 2011, at 6:59 AM, Darren Reed wrote: > On 5/08/11 01:46 AM, Guy Harris wrote: >> ... >> That could, in theory, be fixed - for example, BSD/OS's BPF interpreter had >> an instruction that would do IPv6 extension header parsing >> > > How much interest is there in that? > And what w

Re: [tcpdump-workers] Warning on enabling ip6 protochain 6

2011-08-05 Thread Darren Reed
On 5/08/11 01:46 AM, Guy Harris wrote: ... That could, in theory, be fixed - for example, BSD/OS's BPF interpreter had an instruction that would do IPv6 extension header parsing How much interest is there in that? And what would the functional requirements be? I've written a prototype BP

Re: [tcpdump-workers] Warning on enabling ip6 protochain 6

2011-08-04 Thread Guy Harris
On Aug 4, 2011, at 10:46 PM, ramkumar.parana...@gmail.com wrote: > Is there any way other than ip6 protochain 6 to filter ipv6 traffic with > extension headers and tcp ? Other than constructing your own BPF program (which would probably look like what "ip6 protochain 6" generated, complete wit

Re: [tcpdump-workers] Warning on enabling ip6 protochain 6

2011-08-04 Thread ramkumar . paranandi
Is there any way other than ip6 protochain 6 to filter ipv6 traffic with extension headers and tcp ? Sent from my iPad On Aug 5, 2011, at 1:04 AM, Guy Harris wrote: > > On Aug 4, 2011, at 9:42 PM, ramkumar p wrote: > >> If we specify "ip6 tcp port 25 " does this also filter the traffic with

Re: [tcpdump-workers] Warning on enabling ip6 protochain 6

2011-08-04 Thread Guy Harris
On Aug 4, 2011, at 9:42 PM, ramkumar p wrote: > If we specify "ip6 tcp port 25 " does this also filter the traffic with IPv6 > and extension headers like Routing, Fragment,hop and destination options > etc... and tcp port 25 No. > or it filters only ipv6 traffic without extension > headers and

Re: [tcpdump-workers] Warning on enabling ip6 protochain 6

2011-08-04 Thread ramkumar p
Hi, Thanks good info. If we specify "ip6 tcp port 25 " does this also filter the traffic with IPv6 and extension headers like Routing, Fragment,hop and destination options etc... and tcp port 25 or it filters only ipv6 traffic without extension headers and tcp port 25 Thanks, ./Ram On Thu, A

Re: [tcpdump-workers] Warning on enabling ip6 protochain 6

2011-08-04 Thread Guy Harris
On Aug 2, 2011, at 4:42 PM, ramkumar p wrote: > I am receiving warning that kernel filter failed: invalid argument when I > enable ip6 protochain 6 to filter tcp traffic. That warning means that the filter code generated for "ip6 protochain 6" was rejected by the Linux kernel socket filter

[tcpdump-workers] Warning on enabling ip6 protochain 6

2011-08-02 Thread ramkumar p
Hi, I am receiving warning that kernel filter failed: invalid argument when I enable ip6 protochain 6 to filter tcp traffic. Thanks, Ram- This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.