Advanced IPv6 Analysis in Wireshark
Now that you're familiar with basic IPv6 filtering, let's explore more advanced analysis techniques in Wireshark to gain deeper insights into IPv6 traffic patterns.
IPv6 Protocol Analysis
Analyzing ICMPv6 for Neighbor Discovery
ICMPv6 plays a crucial role in IPv6 networks, especially for Neighbor Discovery Protocol (NDP), which replaces ARP in IPv4. Let's analyze NDP traffic:
- Open Wireshark with our capture file
- Apply the following filter to see all NDP messages:
icmpv6.type >= 133 and icmpv6.type <= 137
This filter includes:
- Type 133: Router Solicitation
- Type 134: Router Advertisement
- Type 135: Neighbor Solicitation
- Type 136: Neighbor Advertisement
- Type 137: Redirect Message
If you don't see any NDP messages in your capture, let's generate some:
## In a new terminal, start a new Wireshark capture on the appropriate interface
wireshark -i eth0 &
## Then run this command to trigger neighbor solicitation
ping6 -c 2 ff02::1
This pings the IPv6 all-nodes multicast address, which should trigger neighbor discovery messages.
IPv6 uses extension headers to include optional information. To filter for packets with extension headers:
ipv6.nxt != 6 and ipv6.nxt != 17 and ipv6.nxt != 58
This shows IPv6 packets that don't have TCP, UDP, or ICMPv6 as their next header, indicating they likely use extension headers.
Wireshark provides several statistical tools that are valuable for analyzing IPv6 traffic.
IPv6 Conversation Statistics
To view IPv6 conversations:
- Click on the "Statistics" menu
- Select "Conversations"
- Click on the "IPv6" tab
This displays all IPv6 conversations in your capture, showing source and destination addresses, packet counts, and byte counts.
You can sort the conversations by any column by clicking on the column header.
IPv6 Protocol Hierarchy
To see the distribution of protocols in your capture:
- Click on the "Statistics" menu
- Select "Protocol Hierarchy"
This shows a hierarchical view of protocols, with percentages of packets and bytes for each protocol. You can see what proportion of your traffic is IPv6, and within that, how much is ICMPv6, TCP, UDP, etc.
IPv6 Endpoint Statistics
To analyze IPv6 endpoints:
- Click on the "Statistics" menu
- Select "Endpoints"
- Click on the "IPv6" tab
This shows all IPv6 addresses seen in the capture, along with packet and byte counts. It helps identify the most active IPv6 hosts.
Flow Graph Analysis
For a visual representation of packet exchanges:
- Click on the "Statistics" menu
- Select "Flow Graph"
- In the options, ensure "IPv6 addresses" is selected for the flow type
- Click "OK"
This creates a visual representation of packet flows between hosts, making it easier to understand communication patterns.
Exporting Data for Further Analysis
To export IPv6 data for analysis in other tools:
- Click on the "File" menu
- Select "Export Packet Dissections"
- Choose "As CSV" (or another format depending on your needs)
- Select which fields to export
- Click "Save"
Let's export some basic IPv6 information:
## Create a simple export from the command line
tshark -r /home/labex/project/ipv6_capture.pcapng -T fields -e frame.number -e ipv6.src -e ipv6.dst -e ipv6.nxt -E header=y -E separator=, > /home/labex/project/ipv6_analysis.csv
This creates a CSV file with frame numbers, source and destination IPv6 addresses, and next header values.
To view the exported file:
cat /home/labex/project/ipv6_analysis.csv
You should see output similar to:
frame.number,ipv6.src,ipv6.dst,ipv6.nxt
1,::1,::1,58
2,::1,::1,58
...
Creating a Custom IPv6 Profile
For frequent IPv6 analysis, it's helpful to create a custom profile:
- Click on the "Edit" menu
- Select "Configuration Profiles"
- Click the "+" button to add a new profile
- Name it "IPv6 Analysis"
- Click "OK"
Now you can customize this profile with your preferred IPv6 filters, column layouts, and colors. Whenever you need to analyze IPv6 traffic, you can switch to this profile.
To add a useful column for IPv6 analysis:
- Right-click on any column header
- Select "Column Preferences"
- Click "+" to add a new column
- For "Title", enter "Next Header"
- For "Type", select "Custom"
- For "Fields", enter "ipv6.nxt"
- Click "OK"
This adds a column showing the IPv6 Next Header value, making it easier to identify the protocol encapsulated in each IPv6 packet.
With these advanced analysis techniques, you now have a comprehensive toolkit for investigating IPv6 traffic patterns, identifying potential issues, and gaining deeper insights into IPv6 network behavior.