2. Examples for tcpdump packet dumps
Prev Chapter 14. Network debugging Next

2. Examples for tcpdump packet dumps

Here some examples of captured packets are shown, perhaps useful for your own debugging...

...more coming next...

2.1. Router discovery

2.1.1. Router advertisement

15:43:49.484751 fe80::212:34ff:fe12:3450 > ff02::1: icmp6: router
¬ advertisement(chlim=64, router_ltime=30, reachable_time=0,
¬ retrans_time=0)(prefix info: AR valid_ltime=30, preffered_ltime=20,
¬ prefix=2002:0102:0304:1::/64)(prefix info: LAR valid_ltime=2592000,
¬ preffered_ltime=604800, prefix=2001:0db8:0:1::/64)(src lladdr:
¬ 0:12:34:12:34:50) (len 88, hlim 255)

Router with link-local address ”fe80::212:34ff:fe12:3450” send an advertisement to the all-node-on-link multicast address ”ff02::1” containing two prefixes ”2002:0102:0304:1::/64” (lifetime 30 s) and ”2001:0db8:0:1::/64” (lifetime 2592000 s) including its own layer 2 MAC address ”0:12:34:12:34:50”.

2.1.2. Router solicitation

15:44:21.152646 fe80::212:34ff:fe12:3456 > ff02::2: icmp6: router solicitation
¬ (src lladdr: 0:12:34:12:34:56) (len 16, hlim 255)

Node with link-local address ”fe80::212:34ff:fe12:3456” and layer 2 MAC address ”0:12:34:12:34:56” is looking for a router on-link, therefore sending this solicitation to the all-router-on-link multicast address ”ff02::2”.

2.2. Neighbor discovery

2.2.1. Neighbor discovery solicitation for duplicate address detection

Following packets are sent by a node with layer 2 MAC address ”0:12:34:12:34:56” during autoconfiguration to check whether a potential address is already used by another node on the link sending this to the solicited-node link-local multicast address.

  • Node wants to configure its link-local address ”fe80::212:34ff:fe12:3456”, checks for duplicate now

15:44:17.712338 :: > ff02::1:ff12:3456: icmp6: neighbor sol: who has
¬ fe80::212:34ff:fe12:3456(src lladdr: 0:12:34:12:34:56) (len 32, hlim 255)

  • Node wants to configure its global address ”2002:0102:0304:1:212:34ff:fe12:3456” (after receiving advertisement shown above), checks for duplicate now

15:44:21.905596 :: > ff02::1:ff12:3456: icmp6: neighbor sol: who has
¬ 2002:0102:0304:1:212:34ff:fe12:3456(src lladdr: 0:12:34:12:34:56) (len 32,
¬ hlim 255)

  • Node wants to configure its global address ”2001:0db8:0:1:212:34ff:fe12:3456” (after receiving advertisement shown above), checks for duplicate now

15:44:22.304028 :: > ff02::1:ff12:3456: icmp6: neighbor sol: who has
¬ 2001:0db8:0:1:212:34ff:fe12:3456(src lladdr: 0:12:34:12:34:56) (len 32, hlim
¬ 255)

2.2.2. Neighbor discovery solicitation for looking for host or gateway

  • Node wants to send packages to ”2001:0db8:0:1::10” but has no layer 2 MAC address to send packet, so send solicitation now

13:07:47.664538 2002:0102:0304:1:2e0:18ff:fe90:9205 > ff02::1:ff00:10: icmp6:
¬ neighbor sol: who has 2001:0db8:0:1::10(src lladdr: 0:e0:18:90:92:5) (len 32,
¬ hlim 255)

  • Node looks for ”fe80::10” now

13:11:20.870070 fe80::2e0:18ff:fe90:9205 > ff02::1:ff00:10: icmp6: neighbor
¬ sol: who has fe80::10(src lladdr: 0:e0:18:90:92:5) (len 32, hlim 255)
Prev Up Next
1. Server socket binding Home Chapter 15. Support for persistent IPv6 configuration in Linux distributions