Detect ip proto 48 [ipv6] ?

Zeek
1

2 13:59:42.305909 62.46.161.181 -> 21.3.4.16 IP IPv6 hop-by-hop
option (0x00)

Bro not event this,

Correct. Bro's IPv6 support doesn't currently support IPv6 options (either
hop-by-hop or end-to-end). If someone wants to contribute that, that would
be great. For LBL, it's currently not a high priority, so will likely take
a while to be addressed.

    Vern

2

Vern Paxson <vern@icir.org> writes:

2 13:59:42.305909 62.46.161.181 -> 21.3.4.16 IP IPv6 hop-by-hop
option (0x00)

Bro not event this,

Correct. Bro's IPv6 support doesn't currently support IPv6 options (either
hop-by-hop or end-to-end). If someone wants to contribute that, that would
be great. For LBL, it's currently not a high priority, so will likely take
a while to be addressed.

Why is there an IPv6 option protocol number appearing in an IPv4 packet?
Maybe it's just a bad packet.

-- david