Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using tcpdump on routing software, and trying to check whether the presence of ip/ip6 protocol with an ip6/ip host (i.e., the other IP family), or else specifying a mix of IPv4 and IPv6 IPs as hosts, is redundant, meaningless, or a user data sanitisation error. Or else, whether it can make reasonable sense as tcpdump capture parameters.

Is it consistent -- or capable of making sense - to specify tcpdump with proto='ip' but hosts that include IPv6 IPs (or proto='ip6' but hosts that include IPv4)?

Can that ever make sense or return valid results? If so, when?

Thanks for any quick input, it'll help!

share|improve this question

migrated from May 20 '13 at 13:04

This question came from our site for professional and enthusiast programmers.

Something like this?

# tcpdump -i eth0 '(ip or ip6) and host'

The above example is slightly more elaborate than it needs to be, to illustrate a point. The following will work fine too. is a dual-stack host that includes A and AAAA records -- tcpdump automatically does 'or' logic that combines results when resolving a DNS host.

# tcpdump -i eth0 'host'

This is effectively the same as:

# tcpdump -i eth0 '(host or host 2404:6800:4006:800::1011)'
share|improve this answer
Now that would make sense :-) – Sander Steffann May 20 '13 at 10:27
See below, and yes, a good example of mixed ipv4/ipv6 in the hosts! I'm also thinking of esoteric cases others might need, and trying to find out if it can ever make sense for proto to be specified as ip or ip6, but then host to include ips of the "other" protocol. – Stilez May 20 '13 at 12:16

An IPv4 packet always has IPv4 source and destination addresses, and an IPv6 packet always has IPv6 source and destination addresses.

I don't really understand what you are trying to do, and I guess that means: "No, it doesn't make sense"

share|improve this answer
I'm cleaning up an existing function that includes packet tracing for the user. The existing function allows the user to choose ipv4/ipv6/any, and also to enter ipv4/ipv6 hosts. I have the same thought you do - seemingly it wouldn't make sense so I should trap it as a user input error. But I need an expert response because I am not 100% sure. For example, might there be situations where IPv4/6 tunnelling or encapsulation or some other network context, means that these would be valid arguments for tcpdump, even if the situation was unusual and esoteric? – Stilez May 20 '13 at 12:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.