I'm using tcpdump on routing software, and trying to check whether the presence of ip/ip6 protocol with an ip6/ip host (i.e., the other IP family), or else specifying a mix of IPv4 and IPv6 IPs as hosts, is redundant, meaningless, or a user data sanitisation error. Or else, whether it can make reasonable sense as tcpdump capture parameters.

Is it consistent -- or capable of making sense - to specify tcpdump with proto='ip' but hosts that include IPv6 IPs (or proto='ip6' but hosts that include IPv4)?

Can that ever make sense or return valid results? If so, when?

Thanks for any quick input, it'll help!

2 Answers 2


Something like this?

# tcpdump -i eth0 '(ip or ip6) and host www.google.com'

The above example is slightly more elaborate than it needs to be, to illustrate a point. The following will work fine too. www.google.com is a dual-stack host that includes A and AAAA records -- tcpdump automatically does 'or' logic that combines results when resolving a DNS host.

# tcpdump -i eth0 'host www.google.com'

This is effectively the same as:

# tcpdump -i eth0 '(host or host 2404:6800:4006:800::1011)'
  • 1
    Now that would make sense :-) May 20, 2013 at 10:27
  • See below, and yes, a good example of mixed ipv4/ipv6 in the hosts! I'm also thinking of esoteric cases others might need, and trying to find out if it can ever make sense for proto to be specified as ip or ip6, but then host to include ips of the "other" protocol.
    – Stilez
    May 20, 2013 at 12:16

An IPv4 packet always has IPv4 source and destination addresses, and an IPv6 packet always has IPv6 source and destination addresses.

I don't really understand what you are trying to do, and I guess that means: "No, it doesn't make sense"

  • I'm cleaning up an existing function that includes packet tracing for the user. The existing function allows the user to choose ipv4/ipv6/any, and also to enter ipv4/ipv6 hosts. I have the same thought you do - seemingly it wouldn't make sense so I should trap it as a user input error. But I need an expert response because I am not 100% sure. For example, might there be situations where IPv4/6 tunnelling or encapsulation or some other network context, means that these would be valid arguments for tcpdump, even if the situation was unusual and esoteric?
    – Stilez
    May 20, 2013 at 12:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.