IPv6 and ICMPv6 traffic with Wireshark
You sort the IPv6 addresses in a capture by type (link-local, unique local, multicast), read ICMPv6 messages and Neighbor Discovery (NDP), work out the solicited-node multicast address, compare dual-stack DNS (A and AAAA), find the computer’s IPv6 address and write a note on IPv6 visibility. The address differs in every lab.
Level 101 · 45 min
The network team says "we don’t have IPv6". Elif isn’t sure: "Modern operating systems switch IPv6 on by default. If nobody watches it, it becomes an invisible path for attackers. Look at this capture."
IPv6 addresses are 128 bits, written as eight hexadecimal groups; runs of zero groups shorten to :: (fd00:20:0:0:0:0:0:23 = fd00:20::23). What ARP does in IPv4 is done in IPv6 by Neighbor Discovery (NDP) inside ICMPv6: who is the router, what is this address’s MAC?
Analogy: if IPv4 is a neighbourhood’s old street names, IPv6 is the same neighbourhood’s new postcodes. The houses are the same, but if nobody checks letters arriving with the new addresses, the door stays open. The capture: ~/captures/ipv6.pcapng.
What you will do in this lesson
- Open the capture and filter IPv6
- Address types
- ICMPv6 message types
- Neighbor Solicitation: whose address is asked?
- The solicited-node multicast address
- IPv6 ping
- Dual-stack DNS: A and AAAA
- The computer’s IPv6 address
- An IPv6 visibility note
- Short quiz
Skills you will earn
- Filtering IPv6 traffic
- Telling IPv6 address types apart
- Reading ICMPv6 message types
- Reading Neighbor Discovery (NDP) and the solicited-node address
- Reading AAAA answers in dual-stack DNS
- Writing advice on IPv6 visibility
← Exporting from Wireshark · Wireshark fundamentals · Wireshark: extracting fields with tshark →
Start for free