 | 1 | initial version |
The provided capture is very informative. When you apply the display filter icmpv6.type == nnn, where nnn is either 135, 130 or 143, you'll notice that the ICMPv6 MLD packets have an IPv6 option included in the IPv6 layer, while the ICMPv6 NS packets do not have that IPv6 option in the IPv6 layer. Why is that important? Because the capture filter is expecting the IPv6 Next Header to be ICMPv6, not something else. That is what the capture filter expression says. Since in the packets with ICMPv6 MLD packets the IPv6 Next Header is the IPv6 Hop-by-Hop option, the capture filter does not accept this packet.
The method to investigate this is to use tcpdump or dumpcap to show the BPF code created for the capture filter expression (use option -d for this). if you match this to the actual packet octets, you'll see how the capture filter applies to the packets involved.
Another noticeable thing is that some packets have an VLAN layer in between as well. These will also not match the capture filter.
