The prefix 2000::/3 has been assigned for global unicast traffic - that is, traffic you should see on the public internet. Most of the traffic in the capture starts with “2”. In my sample capture I see the following /16s (which we’ll call chunks for now): In Wireshark you can view IPv6 addresses via Statistics→Endpoint List→IPv6 or Statistics→Conversation List→IPv6 or by using the display filter “ipv6”.įirst let’s look at the network prefixes that were captured. Most of the addresses in this post are from IPv6 traffic captured in late January 2011. Many of Wireshark’s web sites have been available over IPv6 for a while and as I’ve looked through various capture files and server logs patterns have emerged.

Wikipedia and RFC 4291 are good places to start. Plenty of others have done that elsewhere. NOTE: I’m not going to explain the basics of IPv6 address formats. However, those clumps can provide useful information.īelow I’ll go over some of the address types I’ve seen and show you what information they provide. If you’ve been in the networking world any length of time IPv4’s dotted quad is most likely seared into your brain and clumps of hexadecimal digits of varying lengths can can be hard to wrap your head around. A common complaint about IPv6 is that addresses are “hard to read”.

Wireshark mac addresses