Wireshark is the industry-standard network protocol analyzer that provides deep insight into IPv6 network traffic. This comprehensive guide covers everything from starting your first IPv6 packet capture to advanced analysis techniques for troubleshooting complex network issues.
Launch Wireshark with appropriate permissions (administrator/root access required for live capture)
Select your network interface from the interface list. Look for the interface with active IPv6 traffic, typically indicated by traffic graphs in the interface selector.
Start capturing by double-clicking the interface or clicking the shark fin icon in the toolbar.
Capture both IPv4 and IPv6 simultaneously - Wireshark captures all traffic by default, so no special configuration is needed to capture both protocol versions together.
Wireshark uses two types of filters with different purposes:
Capture Filters (applied before capture starts):
ip6 to capture only IPv6 trafficDisplay Filters (applied after capture):
ipv6 to display only IPv6 trafficFor most IPv6 analysis tasks, it's recommended to capture all traffic and use display filters to focus on specific protocols.
View all IPv6 traffic:
ipv6
View all ICMPv6 traffic:
icmpv6
View IPv6 TCP traffic:
ipv6 and tcp
View IPv6 UDP traffic:
ipv6 and udp
Exclude IPv6 from view (show only IPv4):
!ipv6
Filter by IPv6 address:
ipv6.addr == 2001:db8::1
Filter by source or destination:
ipv6.src == 2001:db8::1
ipv6.dst == 2001:db8::2
Filter by IPv6 address range:
ipv6.addr == 2001:db8::/32
Filter for packets with extension headers:
ipv6.nxt != 6 and ipv6.nxt != 17 and ipv6.nxt != 58
This filters for packets where the "Next Header" field doesn't indicate TCP (6), UDP (17), or ICMPv6 (58), suggesting extension headers are present.
When you expand the "Internet Protocol Version 6" section in Wireshark's packet details pane, you'll see:
Next Header Field: This field is critical for understanding packet structure. Common values include:
Hop Limit Analysis: Track packet paths by observing hop limit decrements. A hop limit of 1 indicates the packet can traverse only one more router before being dropped.
NDP is fundamental to IPv6 operation, replacing ARP and providing additional functionality. Understanding NDP in Wireshark is essential for IPv6 troubleshooting.
Router Solicitation (Type 133):
icmpv6.type == 133
Sent by hosts to discover routers on the local link. Look for these when a host first connects to the network.
Router Advertisement (Type 134):
icmpv6.type == 134
Sent by routers to advertise their presence, prefixes, and network configuration. Contains crucial information like prefix length, default gateway, and RDNSS (DNS) options.
Neighbor Solicitation (Type 135):
icmpv6.type == 135
Similar to ARP requests in IPv4. Used for address resolution and duplicate address detection (DAD).
Neighbor Advertisement (Type 136):
icmpv6.type == 136
Response to Neighbor Solicitation messages, providing link-layer addresses.
Redirect (Type 137):
icmpv6.type == 137
Sent by routers to inform hosts of better first-hop routers for specific destinations.
Key observations when analyzing NDP:
Multicast Addresses: NDP uses specific multicast addresses. Neighbor Solicitations typically use solicited-node multicast addresses (ff02::1:ff00:0/104) as destinations. In Wireshark, you'll see Ethernet destination addresses starting with 33:33 (IPv6 multicast MAC prefix).
DAD Process: When a host configures an IPv6 address, it sends a Neighbor Solicitation with source address :: (all zeros) to check if the address is already in use. If no Neighbor Advertisement returns, the address is considered unique.
Router Discovery: Hosts send Router Solicitations to ff02::2 (all-routers multicast) on startup. Routers respond with Router Advertisements to ff02::1 (all-nodes multicast) containing network configuration.
RDNSS Options: Modern IPv6 networks include Recursive DNS Server (RDNSS) information in Router Advertisements. Filter with:
icmpv6.opt.rdnss
Extension headers provide IPv6's extensibility and handle optional processing. Most typical IPv6 packets don't include extension headers, but understanding them is crucial for security analysis and advanced troubleshooting.
When an extension header is present, it appears as an expandable section below the IPv6 header in the packet details pane. To analyze:
Display Filter for Routing Headers:
ipv6.routing
Display Filter for Fragment Headers:
ipv6.fragment
Be aware that some systems drop IPv6 packets with excessive extension headers (typically more than 15 of any type). Unusual extension header usage may indicate:
Link-Local Communication:
ipv6.addr == fe80::/10
Link-local addresses (fe80::/10) are used for local network communication, especially NDP messages. Heavy link-local traffic is normal and indicates proper IPv6 operation.
Multicast Traffic:
ipv6.dst == ff00::/8
IPv6 relies heavily on multicast instead of broadcast. Common multicast addresses:
ICMPv6 Echo (Ping):
icmpv6.type == 128 or icmpv6.type == 129
Type 128 = Echo Request, Type 129 = Echo Reply. Useful for basic connectivity testing.
Filter for DHCPv6:
dhcpv6
DHCPv6 uses UDP ports 546 (client) and 547 (server). Watch for:
Verify Basic Connectivity:
icmpv6.type == 134icmpv6.type == 128 or icmpv6.type == 129Analyze Routing Issues:
icmpv6.type < 128Investigate Performance Problems:
ipv6.fragmentDNS Resolution Checking:
dns and ipv6
Verify DNS queries use IPv6 transport and return AAAA records for IPv6-enabled services.
IPv6 Statistics Menu:
Expert Info:
Flow Graphs:
Capture at the right location: Place your capture as close as possible to where the problem occurs - on the client, server, or router interface.
Limit capture duration: IPv6 traffic can be verbose due to NDP and multicast. Capture for specific time windows when problems occur.
Use appropriate filters: If investigating a specific issue, use capture filters to reduce file size:
ip6 and host 2001:db8::1
Include link-local traffic: Don't filter out fe80::/10 addresses, as they're essential for NDP analysis.
Start broad, narrow down: Begin with general filters like ipv6, then add specific criteria as you identify issues.
Check both directions: Use "Follow > TCP Stream" or "Follow > UDP Stream" to see both directions of communication.
Compare with working scenarios: Capture traffic from both working and non-working hosts to identify differences.
Document your findings: Use Wireshark's packet commenting feature (right-click > Packet Comment) to annotate interesting packets.
Export specific packets: Use File > Export Specified Packets to share relevant captures without exposing entire network traces.
To practice IPv6 analysis or generate test traffic for troubleshooting, visit test-ipv6.run in your browser. This website performs comprehensive IPv6 connectivity tests and generates various types of IPv6 traffic patterns:
Capture traffic while running test-ipv6.run to see real-world examples of:
Mastering Wireshark for IPv6 analysis requires understanding both the protocol fundamentals and the tool's powerful filtering and analysis capabilities. Start with basic packet captures and simple filters, then gradually explore more advanced features like extension header analysis and NDP troubleshooting.
Remember that IPv6 traffic patterns differ significantly from IPv4 - multicast replaces broadcast, NDP replaces ARP, and extension headers provide new functionality. Regular practice with real-world captures is the best way to develop proficiency.
Keep Wireshark updated to ensure the latest IPv6 protocol dissectors are available, and leverage the extensive Wireshark documentation and community resources when encountering unusual packet structures or behaviors.
With these skills, you'll be well-equipped to diagnose IPv6 connectivity issues, analyze network performance, and ensure your IPv6 deployment operates smoothly and securely.