# giving IPv6 capture filter support

**URL:** <https://community.zeek.org/t/giving-ipv6-capture-filter-support/1161>\
**Category:** Zeek\
**Created:** [April 3, 2007, 5:32am UTC](https://community.zeek.org/t/giving-ipv6-capture-filter-support/1161 "2007-04-03T05:32:48Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bindiya\_V\_S](https://avatars.discourse-cdn.com/v4/letter/b/c89c15/32.png) [@Bindiya\_V\_S](https://community.zeek.org/u/Bindiya_V_S)\
**Post date:** [April 3, 2007, 5:32am UTC](https://community.zeek.org/t/giving-ipv6-capture-filter-support/1161/1 "2007-04-03T05:32:48Z")

</div>

Hello all,  
I want BRO to detect IPv6 packets. I tried giving capture  
filter as  
redef capture\_filters = { ["tcp"]= "tcp", ["udp"] = "udp",  
["icmp"] = "icmp", ["ipv6"] = "ether proto 0x86dd"};

BRO is not complaining, but the packets are not even  
recognised at Sesssions.cc NextPacket.

Thank you  
Bindiya

---

<div class="post-metadata">

**Author:** ![Julien\_Desfossez](https://avatars.discourse-cdn.com/v4/letter/j/6a8cbe/32.png) [@Julien\_Desfossez](https://community.zeek.org/u/Julien_Desfossez)\
**Post date:** [April 3, 2007, 11:55am UTC](https://community.zeek.org/t/giving-ipv6-capture-filter-support/1161/2 "2007-04-03T11:55:48Z")

</div>

Hello,

You can use the following syntax to add IPv6 support :

redef capture\_filters += {  
&nbsp;&nbsp;&nbsp;&nbsp;["ipv6"] = "ip6"  
};

With that filter, Bro will capture all IPv6 traffic.

Sessions.cc recognises TCP and UDP over IPv6 if there is no extension header.  
ICMPv6 has a different protocol number than ICMP (v4).  
So you must replace the

if ( proto != IPPROTO\_TCP && proto != IPPROTO\_UDP && proto != IPPROTO\_ICMP ) {...}

in DoNextPacket by :

if ( proto != IPPROTO\_TCP && proto != IPPROTO\_UDP && proto != IPPROTO\_ICMP && proto != IPPROTO\_ICMPV6) {...}

So your packet won't be dumped.

With that, you'll see in your Weird logs something like "unknow protocol 58" when you ping6 for example.

Because the "switch (proto) {}" doesn't look for IPPROTO\_ICMPV6.

HTH,

Julien Desfossez

Bindiya V S a écrit :

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/giving-ipv6-capture-filter-support/1161/3 "2022-05-06T15:38:14Z")

</div>