Monday, February 25, 2013

IPv6 in Wireshark



IPv6 address beginning with fe80::.. is used for local network.

http://en.wikipedia.org/wiki/IPv6_address

fe80::/10 — Addresses in the link-local prefix are only valid and unique on a single link. Within this prefix only one subnet is allocated (54 zero bits), yielding an effective format of fe80::/64. The least significant 64 bits are usually chosen as the interface hardware address constructed in modified EUI-64 format. A link-local address is required on every IPv6-enabled interface—in other words, applications may rely on the existence of a link-local address even when there is no IPv6 routing. These addresses are comparable to the auto-configuration addresses 169.254.0.0/16 of IPv4.


You will see strange packets when you open IPv6 pcap files.

Just decode it

1. Decode AS...


2. select 'Network' tap and then IPv6



3. Now we have IPv6's packet streams
 
 

No comments:

Post a Comment