Networking beginner here, trying to understand the output of the tcpdump tool using a captured router advertisement packet.
tcpdump -i wlp4s0 -nn -t -c1 -vvv -X -s0
Based on what I've found online, it seems that the router advertisement message is supposed to begin with the value 134 (0x86) as the first byte:
However, in the tcpdump output, I don't see 0x86 (134) anywhere at all. Here is the first line of the hex/ascii output obtained using the -X option:
0x0000: 6000 0000 0068 3aff fe80 0000 0000 0000 `....h:.........
Shouldn't the first byte be equal to 0x86? Where do I begin looking for the data shown in the diagram?
Best Answer
From the tcpdump manual page:
So you're looking at the IPv6 header, which starts with 6.
The header is 40 bytes long, so in your example you see only a portion of the IPv6 header and nothing of the payload. But it is enough to tell that there are no extension headers as the Next Header field (7th byte) is 0x3a = 58, which indicates ICMPv6.
The ICMPv6 header is 8 bytes long, so if you want to see the raw RA data, then you need to display a few lines more (the RA will be from byte 0x0030 onwards).