Hi, with tshark-0.99.7 i can capture all ipv6 multicast packet: sfc-monitor# tshark -i em2 -R 'ipv6.dst[0:1]==ff' -z io,stat,1 =================================================================== IO Statistics Interval: 1.000 secs Column #0: | Column #0 Time |frames| bytes 000.000-001.000 58 20644 ===================================================================
but with tshark-1.0.0 the syntax become wrong: sfc-monitor# ./tshark -i em2 -R 'ipv6.dst[0:1]==ff' -z io,stat,1 tshark: Protocol ("ff") cannot appear on right-hand side of comparison. sfc-monitor# any suggestions? regards, -dikshie- _______________________________________________ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users