How would you spot IPv6 traffic in a capture?

• A. Look at the DNS response and compare to request ID
• B. Use the filter ipv6 to show only IPv6 packets or inspect IPv6 headers
• C. Sort by protocol name only
• D. Check the TCP port numbers

Answer: (B)

Spotting IPv6 traffic hinges on recognizing its header. In Wireshark, IPv6 packets carry a dedicated IPv6 header, and the Version field in that header is set to 6 with 128‑bit source and destination addresses. The simplest way to isolate IPv6 traffic is to apply the display filter ipv6, which shows only frames that contain an IPv6 header. If you click into a packet, you’ll see the IPv6 section with fields like Version = 6, Traffic Class, Flow Label, Payload Length, Next Header, Hop Limit, and the Source and Destination addresses in the familiar colon-separated IPv6 notation. While you can manually inspect headers, filtering is the most reliable and efficient method to focus solely on IPv6 traffic. The other options don’t specifically identify IPv6 packets: DNS response vs request IDs relate to DNS, sorting by protocol name doesn’t limit by IP version, and checking TCP port numbers doesn’t indicate whether the packet uses IPv4 or IPv6.