# Reassembly of IPv6 TCP streams

**URL:** <https://community.zeek.org/t/reassembly-of-ipv6-tcp-streams/2145>\
**Category:** Zeek\
**Created:** [December 6, 2011, 12:20am UTC](https://community.zeek.org/t/reassembly-of-ipv6-tcp-streams/2145 "2011-12-06T00:20:21Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jim\_Mellander](https://avatars.discourse-cdn.com/v4/letter/j/e47c2d/32.png) [@Jim\_Mellander](https://community.zeek.org/u/Jim_Mellander)\
**Post date:** [December 6, 2011, 12:20am UTC](https://community.zeek.org/t/reassembly-of-ipv6-tcp-streams/2145/1 "2011-12-06T00:20:21Z")

</div>

Hi all:

contents.bro performs session reconstruction of IPv4 traffic, but when  
running Bro 1.5 contents.bro against an IPv6 packet trace, it creates  
0-length files, but doesn't extract the session contents to those  
files. Is this in the works?

Thanks in advance

---

<div class="post-metadata">

**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\
**Post date:** [December 6, 2011, 3:50am UTC](https://community.zeek.org/t/reassembly-of-ipv6-tcp-streams/2145/2 "2011-12-06T03:50:37Z")

</div>

That will be part of the work for 2.1. I'll file a ticket for that to make sure we look into it.

&nbsp;&nbsp;.Seth

---

<div class="post-metadata">

**Author:** ![Jim\_Mellander](https://avatars.discourse-cdn.com/v4/letter/j/e47c2d/32.png) [@Jim\_Mellander](https://community.zeek.org/u/Jim_Mellander)\
**Post date:** [December 6, 2011, 10:56pm UTC](https://community.zeek.org/t/reassembly-of-ipv6-tcp-streams/2145/3 "2011-12-06T22:56:53Z")

</div>

As a workaround, the latest version of tcpflow 1.0.2 (  
[http://freecode.com/projects/tcpflow](http://freecode.com/projects/tcpflow) ) performs IPv6 session  
reassembly into files. I had to hack it a bit to get it to work on  
freebsd, but will be submitting the patches upstream.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:40pm UTC](https://community.zeek.org/t/reassembly-of-ipv6-tcp-streams/2145/4 "2022-05-06T15:40:02Z")

</div>