This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

IPv6 address range filter

0

How do I filter on a range of ipv6 addresses, for example an ipv6 filter similar to ipv4 192.168.0.0/16? I would like to filter on ipv6 addresses on my lan fe80::/10 but cannot seem to find the correct syntax.

Thanks!

asked 30 Dec '10, 20:32

debianuser's gravatar image

debianuser
1111
accept rate: 0%

edited 02 Jan '11, 18:24

Gerald%20Combs's gravatar image

Gerald Combs ♦♦
3.3k92258


3 Answers:

1

Are you trying to apply masks to IPv6 addresses in capture filters or display filters? For capture filters you'd use net:

ip6 net fe00::/10

As Sake said, you can't apply masks to IPv6 addresses in display filters (not yet, at least) but you can use comparison operators:

ipv6.src >= fe80:: && ipv6.src < fec0::

answered 02 Jan '11, 18:24

Gerald%20Combs's gravatar image

Gerald Combs ♦♦
3.3k92258
accept rate: 24%

Love that one, Gerald!

(02 Jan '11, 19:01) martyvis

0

i just tried a few combinations myself, and am also stumped (using both WS 1.2 and 1.4). I thought that I had used this in past, but I'm not sure now.

Even looking through this Sharkfest '10 presentation, I can't find any clues there (lots of mentions of networks with masks, though no screenshots showing a relevant display filter). link text

Maybe no one has implemented this yet. If you don't get any positive responses, file a feature request bug.

answered 30 Dec '10, 21:36

martyvis's gravatar image

martyvis
8911525
accept rate: 7%

0

I just looked at the sourcecode and there is indeed no functionality implemented yet to accept a prefix-length in a display filter. I'm looking into it right now, but as I have not done much with the display filter engine, I'm not sure I will come up with a solution shortly.

Could you file an enhancement request on https://bugzilla.wireshark.org to be sure it won't get lost?

answered 31 Dec '10, 00:59

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%

Done - bug 5538

(31 Dec '10, 04:55) martyvis