Re: [tcpdump-workers] Scanning IP6 packets

2013-11-13 Thread Guy Harris
On Nov 12, 2013, at 7:57 PM, "Steve" wrote: > How can I get a working filter to capture the data I need? Modify the code in libpcap's gencode.c so that the comment in gen_load(): /* * The offset is relative to the beginning of * the transport-l

Re: [tcpdump-workers] SPAM-LOW: Re: Scanning IP6 packets

2013-11-13 Thread Steve
Hi Guy, Thanks for the reply. I tried using the below filter which did pick up some request packets, but (likely as a result of the added header extensions) it was missing some. (ip6[((ip6 [32:1] & 0xf0) >> 2):4] = 0x47455420 or ip6 [((ip6 [32:1] & 0xf0) >> 2):4] = 0x504f5354) As a result, I've