[Bro] Detect ip proto 48 [ipv6] ?

Vern Paxson vern at icir.org
Fri Jul 9 23:27:24 PDT 2004


> Why is there an IPv6 option protocol number appearing in an IPv4 packet?
> Maybe it's just a bad packet.

Perhaps it's an IPv6 packet that has IPv4-embedded addresses, which is why
tcpdump prints IPv4 addresses rather than IPv6?  I wouldn't think tcpdump's
printer could even try to find the presence of an IPv6 hop-by-hop option
in a true IPv4 packet.

		Vern



More information about the Bro mailing list