This content covers how to capture and analyze IPv6 web traffic using Wireshark, with a focus on reading the fields inside an IPv6 packet header.
We're going to take a look at some web traffic and see what it looks like inside Wireshark. Specifically, we're going to look into the IPv6 header and take a look at what information is in that IPv6 header.
The first thing I'm going to do is open up Wireshark, and I'm going to be monitoring my ethernet connection. Once again we start seeing some Cisco traffic coming in, and that's from the switch — the switch is trying to do some discovery, and so we see that discovery that's going out that Cisco port. But what we want to do is generate some web traffic.
So I'm going to open up a browser and then I'm going to type in http colon slash, and we're going to go to an IPv6 address, so I'm going to 0 0 0 0 colon colon colon colon colon colon colon 3 to get to our server that we have, and hit enter. That's going to bring up the web page that we have. I'm going to stop collecting data at this point in time, so I'll stop this capture here. I'm going to go back and just bookmark this so in the future I can just jump straight to this. So I'm going to bookmark this, and there we have it, bookmarked.
So then what we can do is, inside Wireshark we see all of these different frames and packets that have come across here. What I want to do is filter out some of the noise here. So I'm going to type in — in this case it's an IPv6 address, so in the past I've typed in an IPv4 address by doing ip.address; in this case it's ipv6.address — and I am going to type in then the fc00:1::3 into here so we can just look at those, and then hit enter to filter it out.
Now we're seeing just the traffic that's going between the demo laptop and the demo Pi. So we're seeing just the traffic that goes between there. We see the TCP traffic that establishes a connection here — that's the layer 4 that's establishing a connection. We see some HTTP, so now that is the application layer that is transferring data, and so this is the request. The GET right here means that this is the demo laptop reaching out and saying, I would like to get this web page. And then we see the response right here. In fact, we can look down at it line by line, and here we see the TechKnowSurge and the information that came up on that website. So we see it right there, and then it's got some additional information here, and then it closes the connection. So there's the flow of information back and forth between these two devices.
Now let's take a look at what one of those headers looks like. So I'm going to take a look — maybe we do the initial request, which is this HTTP connection right here.
We can see some of the frame information and ethernet information here at the top. We open that up and just take a look, and we see that the ethernet really doesn't change, the frame doesn't really change between IPv4 or IPv6. That's going to remain the same — ethernet is still ethernet. That's one of the advantages of layers: we can develop and grow one layer without affecting all the other layers. So we've transitioned from IPv4 to IP version 6 in the layer 3, but in the layer 2 it still looks the same. We see it is going to the destination of the Raspberry Pi and it is coming from the Dell laptop, which is the demo laptop here. So that all remains the same.
From a layer 3 perspective, it's version 6, so we do see a couple differences with this. Number one, the biggest difference is it is version 6, so it's showing version 6 right here. And then we can see that the addresses are much larger as well. We've got the addresses of the two devices here. Of course it doesn't show the full thing, because it shows the reduced where it takes all the zeros out here, but if we click on it, it actually has the full number of hextets that we have right here. So there's one, two, three, four, five, six, seven, eight — so the eight different hextets that we have in that line right there.
And we have the hop limit in here, and the next header, which is TCP. We look down, and the next header is in fact TCP, we see that right here, so that pans out. And the payload length for this particular one is 451. So if we're to click down here, we can see that that takes a significant portion of this request, this packet, that's right here.
So there we see some of the components that are within an IPv6 header.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →