# ipv6 **URL:** \ **Category:** Zeek\ **Created:** [January 13, 2009, 4:37pm UTC](https://community.zeek.org/t/ipv6/1477 "2009-01-13T16:37:10Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![dikshie](https://avatars.discourse-cdn.com/v4/letter/d/7c8e57/32.png) [@dikshie](https://community.zeek.org/u/dikshie)\ **Post date:** [January 13, 2009, 4:37pm UTC](https://community.zeek.org/t/ipv6/1477/1 "2009-01-13T16:37:10Z")
Hi, 1.any documentation how to use Bro to read and analyze   ipv6 traces? 2.I use Bro-1.4 install from FreeBSD ports by add    --enable-brov6 to CONFIGURE\_ARGS=   but bro fail to read ipv6 traces. 3.does bro can read ip6 multicast traces? with best regards, -dikshie- ---
**Author:** ![Seth\_Hall](https://avatars.discourse-cdn.com/v4/letter/s/50afbb/32.png) [@Seth\_Hall](https://community.zeek.org/u/Seth_Hall)\ **Post date:** [January 13, 2009, 4:44pm UTC](https://community.zeek.org/t/ipv6/1477/2 "2009-01-13T16:44:23Z")
> 2.I use Bro-1.4 install from FreeBSD ports by add >   --enable-brov6 to CONFIGURE\_ARGS= > but bro fail to read ipv6 traces. Make sure that you set your capture filter to include ipv6 traffic. It's not set to include it by default. From the command line you can do -f"ip and ip6" to include all ipv4 and ipv6 traffic. > 3.does bro can read ip6 multicast traces? I don't see why it would have any trouble with multicast.    .Seth ---
**Author:** ![dikshie](https://avatars.discourse-cdn.com/v4/letter/d/7c8e57/32.png) [@dikshie](https://community.zeek.org/u/dikshie)\ **Post date:** [January 13, 2009, 4:51pm UTC](https://community.zeek.org/t/ipv6/1477/3 "2009-01-13T16:51:42Z")
Seth Hall wrote: > > 2.I use Bro-1.4 install from FreeBSD ports by add > >   --enable-brov6 to CONFIGURE\_ARGS= > > but bro fail to read ipv6 traces. > > Make sure that you set your capture filter to include ipv6 traffic. > It's not set to include it by default. From the command line you can do > -f"ip and ip6" to include all ipv4 and ipv6 traffic. i use tcpdump to capture packet. #tcpdump -c 10000 -s 1500 -w ip6.pcap -nvvi em2 ip6 #tcpdump -s 1500 -nvv -w tcp6.pcap -r ip6.pcap tcp #bro -r tcp6.pcap 1231818666.514747 weird: spontaneous\_FIN there are no \*.log files (conn.log, etc). > > 3.does bro can read ip6 multicast traces? > > I don't see why it would have any trouble with multicast. #tcpdump -w multicast.pcap -c 100000 -s 1500 -nvvi em2 ip6 multicast #bro -r multicast.pcap 1231827825.806499 weird: bad\_UDP\_checksum there are no \*.log files. with best regards, -dikshie- ---
**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\ **Post date:** [January 13, 2009, 4:53pm UTC](https://community.zeek.org/t/ipv6/1477/4 "2009-01-13T16:53:13Z")
> 1.any documentation how to use Bro to read and analyze >   ipv6 traces? Nothing extra is needed other than --enable-brov6. Note though that Bro doesn't correctly deal with packets that have options (this is a BPF/pcap limitation, rather than something specific to Bro). > 2.I use Bro-1.4 install from FreeBSD ports by add >    --enable-brov6 to CONFIGURE\_ARGS= >   but bro fail to read ipv6 traces. As usual, reports of failures work much better if you include a trace and command-line invocation that demonstrates the problem, so we can try to reproduce it. > 3.does bro can read ip6 multicast traces? It should be able to read them (as UDP, if that's what they are), but doesn't do any interesting analysis on them.     Vern ---
**Author:** ![rmkml](https://avatars.discourse-cdn.com/v4/letter/r/df705f/32.png) [@rmkml](https://community.zeek.org/u/rmkml)\ **Post date:** [January 13, 2009, 2:56pm UTC](https://community.zeek.org/t/ipv6/1477/5 "2009-01-13T14:56:30Z")
Hi, Bro v1.4.6 with ipv6 compiled works good, small example:   ./bro146ipv6 -r ipv6\_http.pcap -f 'ip6' bro.init mt conn.log:   1186341404.189852 0.029609 2001:6f8:102d:0:2d0:9ff:fee3:e8de 2001:6f8:900:7c0::2 http 59201 80 tcp 240 2259 SF X %1 http.log:   1186341404.199471 %1 start 2001:6f8:102d:0:2d0:9ff:fee3:e8de:59201 \> 2001:6f8:900:7c0::2:80   1186341404.204585 %1 GET / (200 "OK" [2121] [cl-1985.ham-01.de.sixxs.net](http://cl-1985.ham-01.de.sixxs.net)) Regards Rmkml [Crusoe-Researches.com](http://Crusoe-Researches.com) ---
**Author:** ![Seth\_Hall](https://avatars.discourse-cdn.com/v4/letter/s/50afbb/32.png) [@Seth\_Hall](https://community.zeek.org/u/Seth_Hall)\ **Post date:** [January 13, 2009, 6:07pm UTC](https://community.zeek.org/t/ipv6/1477/6 "2009-01-13T18:07:30Z")
Try running with the conn.bro script... #bro -rtcp6.pcap -f "ip6 or ip" conn    .Seth ---
**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\ **Post date:** [January 13, 2009, 6:15pm UTC](https://community.zeek.org/t/ipv6/1477/7 "2009-01-13T18:15:48Z")
> #bro -r tcp6.pcap > > 1231818666.514747 weird: spontaneous\_FIN > > there are no \*.log files (conn.log, etc). Well, you haven't listed a script to process it with. Per the private note I just sent you,   bro -f ip6 -r tcp6.pcap mt will generate the usual log files. (I overlooked -f ip6 - thanks, Seth!)     Vern ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/ipv6/1477/8 "2022-05-06T15:38:50Z")