Wireshark/IPv6 local

Wireshark is a free and open source packet analyzer used for network troubleshooting and analysis. These activities will show you how to use Wireshark to capture and analyze local IPv6 traffic.

Readings edit

Wikipedia: IPv6

Preparation edit

To prepare for this activity:

Start Windows.
Log in if necessary.
Install Wireshark.

Activity 1 - Capture Local IPv6 Traffic edit

To capture local IPv6 traffic:

Use ipconfig to display the default gateway address. Note the Default Gateway displayed. Be sure to select an IPv6 address. If you don't have an IPv6 default gateway, just review the following instructions for content understanding.
Start a Wireshark capture.
Use ping <default gateway address> to ping the default gateway IPv6 address.
Stop the Wireshark capture.

Activity 2 - Analyze Local IPv6 Outbound Traffic edit

To analyze local IPv6 outbound traffic:

Observe the traffic captured in the top Wireshark packet list pane. Look for traffic with ICMPv6 listed as the protocol. To view only ICMPv6 traffic, type icmpv6 (lower case) in the Filter box and press Enter.
Select the first ICMPv6 packet or scroll down if necessary to locate the first packet labeled Echo (ping) request.
Observe the packet details in the middle Wireshark packet details pane. Notice that it is an Ethernet II / Internet Protocol Version 6 / Internet Control Message Protocol v6 frame.
Expand Ethernet II to view Ethernet details.
Observe the Destination field. This should contain the MAC address of your default gateway. You can use netsh interface ipv6 show neighbors to confirm.
Observe the Source field. This should contain your MAC address. You can use ipconfig /all or getmac to confirm.
Observe the Type field. Notice that the type is 0x86dd, indicating IPv6.
Expand Internet Protocol Version 6 to view IPv6 details.
Observe the Source address. Notice that the source address is your IPv6 address.
Observe the Destination address. Notice that the destination address is the default gateway IPv6 address.

Activity 3 - Analyze Local IPv6 Inbound Traffic edit

To analyze local IPv6 inbound traffic:

In the top Wireshark packet list pane, select the next ICMPv6 packet, labeled Echo (ping) reply.
Observe the packet details in the middle Wireshark packet details pane. Notice that it is an Ethernet II / Internet Protocol Version 6 / Internet Control Message Protocol v6 frame.
Expand Ethernet II to view Ethernet details.
Observe the Destination field. This should contain your MAC address.
Observe the Source field. This should contain the MAC address of your default gateway.
Observe the Type field. Notice that the type is 0x86dd, indicating IP.
Expand Internet Protocol Version 6 to view IPv6 details.
Observe the Source address. Notice that the source address is the default gateway IPv6 address.
Observe the Destination address. Notice that the destination address is your IPv6 address.
Close Wireshark to complete this activity. Quit without Saving to discard the captured traffic.