Filter only NS and NA messages that used only in DAD (duplicate address detection process) in IPv6?

edit

Hi Ahmed,

I can't think of a way to filter NS and NA used for DAD because these ICMPv6 packets are the exact same format being used for regular NS and NA traffic.

If you are monitoring a specific interface then you could narrow it down by using the MAC address of that interface.

You can build a display filter by manually entering the link local address of that interface. (FE80)

Ex. using MAC c2:00:54:f5:00:00 this gives you fe80::c000:54ff:fef5:0000

icmpv6.nd.ns.target_address == fe80::c000:54ff:fef5:0

The interface should send NS for its own address only for DAD process.

You may try the same for global addresses depending on how your network is configured.

Hope this helps.

Cheers,

JF