1

Networking beginner here, trying to understand the output of the tcpdump tool using a captured router advertisement packet.

tcpdump -i wlp4s0 -nn -t -c1 -vvv -X -s0

Based on what I've found online, it seems that the router advertisement message is supposed to begin with the value 134 (0x86) as the first byte: enter image description here

However, in the tcpdump output, I don't see 0x86 (134) anywhere at all. Here is the first line of the hex/ascii output obtained using the -X option:

0x0000:  6000 0000 0068 3aff fe80 0000 0000 0000  `....h:.........

Shouldn't the first byte be equal to 0x86? Where do I begin looking for the data shown in the diagram?

Improve this question
1
  • If you need to dive into the packet dissection details, why not have the computer do it for you? Options are to use tshark (the command line variant of Wireshark), or Wireshark (the GUI variant), or save the capture file from tcpdump and load it in tshark/Wireshark afterwards.
    – Jaap Keuter
    Commented Mar 24, 2015 at 15:34

1 Answer 1

Reset to default
4

From the tcpdump manual page:

-X When parsing and printing, in addition to printing the headers of each packet, print the data of each packet (minus its link level header).

So you're looking at the IPv6 header, which starts with 6.

The header is 40 bytes long, so in your example you see only a portion of the IPv6 header and nothing of the payload. But it is enough to tell that there are no extension headers as the Next Header field (7th byte) is 0x3a = 58, which indicates ICMPv6.

The ICMPv6 header is 8 bytes long, so if you want to see the raw RA data, then you need to display a few lines more (the RA will be from byte 0x0030 onwards).

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.