(both in SNI and in certificate)ĥ) How many authoritative DNS answers were sent from my lab? – wrong IPv6 hop limit (234, so started at 255, not 128)Ĥ) Which server (vhost) was accessed in TCP stream 4? – wrong IPv6 hop limit (62, so started at 64, not 128) Reference ID: Unidentified reference source ‘PZF’ Cheers, Sakeġ) What’s the serial number of the Juniper SSG 140?Ģ) What reference time source is used on the stratum 1 NTP server? Hi Johannes, as promised, here are my findings/answers to your questions that I previously sent to you by e-mail. You can filter for some of those mentioned layer 7 protocols such as DNS, NTP, or ICMPv6: Normally this should show ONLY IPv4 packets, but since those tunneled IPv6 packets are within IPv4, they are still present: This can be confusing, especially when using display filters such as “ip”. Note that Wireshark displays the IPv6 source and destination address in the packet list and NOT the IPv4 ones.

Looking at it with Wireshark reveals the outer IPv4 packet with “Protocol: IPv6 (41)”, as well as the inner IPv6 packet with its actual payload: Ref: IANA – Assigned Internet Protocol Numbers. This is *not* UDP or TCP, but its own protocol. Within the trace you’ll find tunneled IPv6 connections with the following protocols:īasically, every IPv6 packet is encapsulated in IPv4, using the IP protocol number 41.

There are some IPv4 packets left within the trace intentionally, just to have some for reference.

Diplaying wireshark ip v4 only