I'm using tcpdump on routing software, and trying to check whether the presence of ip/ip6 protocol with an ip6/ip host (i.e., the other IP family), or else specifying a mix of IPv4 and IPv6 IPs as hosts, is redundant, meaningless, or a user data sanitisation error. Or else, whether it can make reasonable sense as tcpdump capture parameters.
Is it consistent -- or capable of making sense - to specify tcpdump with proto='ip' but hosts that include IPv6 IPs (or proto='ip6' but hosts that include IPv4)?
Can that ever make sense or return valid results? If so, when?
Thanks for any quick input, it'll help!