# Wireshark/DHCPv6

Wireshark is a free and open source packet analyzer used for network troubleshooting and analysis. These activities will show you how to use Wireshark to capture and analyze DHCPv6 traffic.

## Readings

* Wikipedia: DHCPv6

## Preparation

To prepare for this activity:
* Start Windows.
* Log in if necessary.
* Install Wireshark.

## Activity 1 - Capture DHCPv6 Traffic

To capture DHCPv6 traffic:
* Start a Wireshark capture.
* Open a command prompt.
* Type ipconfig /renew6 and press Enter.
* Type ipconfig /release6 and press Enter.
* Type ipconfig /renew6 and press Enter.
* Close the command prompt.
* Stop the Wireshark capture.

## Activity 2 - Analyze DHCPv6 Renew Traffic

To analyze DHCPv6 Renew traffic:
* Observe the traffic captured in the top Wireshark packet list pane. To view only DHCPv6 traffic, type dhcpv6 (lower case) in the Filter box and press Enter.
* In the top Wireshark packet list pane, select the first DHCPv6 packet, labeled DHCPv6 Renew.
* Observe the packet details in the middle Wireshark packet details pane. Notice that it is an Ethernet II / Internet Protocol Version 6 / User Datagram Protocol / DHCPv6 frame.
* Expand Ethernet II to view Ethernet details.
* Observe the Destination and Source fields. The destination should be the DHCPv6 multicast MAC address 33:33:00:01:00:02 and the source should be your MAC address. You can use ipconfig /all and netsh interface ipv6 show neighbors to confirm.
* Expand Internet Protocol Version 6 to view IPv6 details.
* Observe the Source address. Notice that the source address is your link-local IPv6 address.
* Observe the Destination address. Notice that the destination address is the DHCPv6 multicast address ff02::1:2.
* Expand User Datagram Protocol to view UDP details.
* Observe the Source port. Notice that it is dhcpv6-client (546).
* Observe the Destination port. Notice that it is dhcpv6-server (547).
* Expand DHCPv6 to view DHCPv6 details.
* Observe the DHCPv6 Message Type. Notice that it is a Renew (5).
* Observe the Client Identifier and Server Identifier fields.
* Expand Option Request to view option details.
* Observe the requested options.

## Activity 3 - Analyze DHCPv6 Reply Traffic

To analyze DHCPv6 Reply traffic:
* In the top Wireshark packet list pane, select the second DHCPv6 packet, labeled DHCPv6 Reply.
* Observe the packet details in the middle Wireshark packet details pane. Notice that it is an Ethernet II / Internet Protocol Version 6 / User Datagram Protocol / DHCPv6 frame.
* Expand Ethernet II to view Ethernet details.
* Observe the Destination and Source fields. The destination should be your MAC address and the source should be your DHCPv6 server's MAC address.
* Expand Internet Protocol Version 6 to view IPv6 details.
* Observe the Source address. Notice that the source address is the DHCPv6 server IPv6 address.
* Observe the Destination address. Notice that the destination address is your link-local IPv6 address.
* Expand User Datagram Protocol to view UDP details.
* Observe the Source port. Notice that it is a dynamic port.
* Observe the Destination port. Notice that it is dhcpv6-client (546).
* Expand DHCPv6 to view DHCPv6 details.
* Observe the DHCPv6 Message Type. Notice that it is a Reply (7).
* Expand Client Identifier, Server Identifier, and Identity Association to view Reply details.
* Observe the MAC addresses, IPv6 addresses, and lease time, as well as any options if included.

## Activity 4 - Analyze DHCPv6 Release Traffic

To analyze DHCPv6 Release traffic:
* In the top Wireshark packet list pane, select the third DHCPv6 packet, labeled DHCPv6 Release.
* Observe the packet details in the middle Wireshark packet details pane. Notice that it is an Ethernet II / Internet Protocol Version 6 / User Datagram Protocol / DHCPv6 frame.
* Expand Ethernet II to view Ethernet details.
* Observe the Destination and Source fields. The destination should be the DHCPv6 multicast MAC address 33:33:00:01:00:02 and the source should be your MAC address.
* Expand Internet Protocol Version 6 to view IPv6 details.
* Observe the Source address. Notice that the source address is your link-local IPv6 address.
* Observe the Destination address. Notice that the destination address is the DHCPv6 multicast address ff02::1:2.
* Expand User Datagram Protocol to view UDP details.
* Observe the Source port. Notice that it is dhcpv6-client (546).
* Observe the Destination port. Notice that it is dhcpv6-server (547).
* Expand DHCPv6 to view DHCPv6 details.
* Observe the DHCPv6 Message Type. Notice that it is a Release (8).
* Expand Client Identifier, Server Identifier, and Identity Association to view Release details.
* Observe the MAC addresses, IPv6 addresses, and lease time, as well as any options if included. This is the address that will be released on the DHCPv6 server.

## Activity 5 - Analyze DHCPv6 Reply Traffic

To analyze DHCPv6 Reply traffic:
* In the top Wireshark packet list pane, select the second DHCPv6 packet, labeled DHCPv6 Reply.
* Observe the packet details in the middle Wireshark packet details pane. Notice that it is an Ethernet II / Internet Protocol Version 6 / User Datagram Protocol / DHCPv6 frame.
* Expand Ethernet II to view Ethernet details.
* Observe the Destination and Source fields. The destination should be your MAC address and the source should be your DHCPv6 server's MAC address.
* Expand Internet Protocol Version 6 to view IPv6 details.
* Observe the Source address. Notice that the source address is the DHCPv6 server IPv6 address.
* Observe the Destination address. Notice that the destination address is your link-local IPv6 address.
* Expand User Datagram Protocol to view UDP details.
* Observe the Source port. Notice that it is a dynamic port.
* Observe the Destination port. Notice that it is dhcpv6-client (546).
* Expand DHCPv6 to view DHCPv6 details.
* Observe the DHCPv6 Message Type. Notice that it is a Reply (7).
* Expand Client Identifier and Server Identifier to view Reply details.
* Observe the MAC addresses and IPv6 addresses. Notice that there is no Identity Association in reply to an address release.

## Activity 6 - Analyze DHCPv6 Solicit Traffic

To analyze DHCPv6 Solicit traffic:
* In the top Wireshark packet list pane, select the fifth DHCPv6 packet, labeled DHCPv6 Solicit.
* Observe the packet details in the middle Wireshark packet details pane. Notice that it is an Ethernet II / Internet Protocol Version 6 / User Datagram Protocol / DHCPv6 frame.
* Expand Ethernet II to view Ethernet details.
* Observe the Destination and Source fields. The destination should be the DHCPv6 multicast MAC address 33:33:00:01:00:02 and the source should be your MAC address.
* Expand Internet Protocol Version 6 to view IPv6 details.
* Observe the Source address. Notice that the source address is your link-local IPv6 address.
* Observe the Destination address. Notice that the destination address is the DHCPv6 multicast address ff02::1:2.
* Expand User Datagram Protocol to view UDP details.
* Observe the Source port. Notice that it is dhcpv6-client (546).
* Observe the Destination port. Notice that it is dhcpv6-server (547).
* Expand DHCPv6 to view DHCPv6 details.
* Observe the DHCPv6 Message Type. Notice that it is a Solicit (1).
* Expand Client Identifier, Identity Association, and Option Request to view Solicit details.
* Observe the MAC address, as well as any options if included.

## Activity 7 - Analyze DHCPv6 Advertise Traffic

To analyze DHCPv6 Advertise traffic:
* In the top Wireshark packet list pane, select the sixth DHCPv6 packet, labeled DHCPv6 Advertise.
* Observe the packet details in the middle Wireshark packet details pane. Notice that it is an Ethernet II / Internet Protocol Version 6 / User Datagram Protocol / DHCPv6 frame.
* Expand Ethernet II to view Ethernet details.
* Observe the Destination and Source fields. The destination should be your MAC address and the source should be your DHCPv6 server's MAC address.
* Expand Internet Protocol Version 6 to view IPv6 details.
* Observe the Source address. Notice that the source address is the DHCPv6 server IPv6 address.
* Observe the Destination address. Notice that the destination address is your link-local IPv6 address.
* Expand User Datagram Protocol to view UDP details.
* Observe the Source port. Notice that it is a dynamic port.
* Observe the Destination port. Notice that it is dhcpv6-client (546).
* Expand DHCPv6 to view DHCPv6 details.
* Observe the DHCPv6 Message Type. Notice that it is an Advertise (2).
* Expand Client Identifier, Server Identifier, and Identity Association to view Advertise details.
* Observe the MAC addresses, IPv6 addresses, and lease time, as well as any options if included.

## Activity 8 - Analyze DHCPv6 Request Traffic

To analyze DHCPv6 Request traffic:
* In the top Wireshark packet list pane, select the seventh DHCPv6 packet, labeled DHCPv6 Request.
* Observe the packet details in the middle Wireshark packet details pane. Notice that it is an Ethernet II / Internet Protocol Version 6 / User Datagram Protocol / DHCPv6 frame.
* Expand Ethernet II to view Ethernet details.
* Observe the Destination and Source fields. The destination should be the DHCPv6 multicast MAC address 33:33:00:01:00:02 and the source should be your MAC address.
* Expand Internet Protocol Version 6 to view IPv6 details.
* Observe the Source address. Notice that the source address is your link-local IPv6 address.
* Observe the Destination address. Notice that the destination address is the DHCPv6 multicast address ff02::1:2.
* Expand User Datagram Protocol to view UDP details.
* Observe the Source port. Notice that it is dhcpv6-client (546).
* Observe the Destination port. Notice that it is dhcpv6-server (547).
* Expand DHCPv6 to view DHCPv6 details.
* Observe the DHCPv6 Message Type. Notice that it is a Request (3).
* Expand Client Identifier, Identity Association, and Option Request to view Request details.
* Observe the MAC address, as well as any options if included.

## Activity 9 - Analyze DHCPv6 Reply Traffic

To analyze DHCPv6 Reply traffic:
* In the top Wireshark packet list pane, select the eighth DHCPv6 packet, labeled DHCPv6 Reply.
* Observe the packet details in the middle Wireshark packet details pane. Notice that it is an Ethernet II / Internet Protocol Version 6 / User Datagram Protocol / DHCPv6 frame.
* Expand Ethernet II to view Ethernet details.
* Observe the Destination and Source fields. The destination should be your MAC address and the source should be your DHCPv6 server's MAC address.
* Expand Internet Protocol Version 6 to view IPv6 details.
* Observe the Source address. Notice that the source address is the DHCPv6 server IPv6 address.
* Observe the Destination address. Notice that the destination address is your link-local IPv6 address.
* Expand User Datagram Protocol to view UDP details.
* Observe the Source port. Notice that it is a dynamic port.
* Observe the Destination port. Notice that it is dhcpv6-client (546).
* Expand DHCPv6 to view DHCPv6 details.
* Observe the DHCPv6 Message Type. Notice that it is a Reply (7).
* Expand Client Identifier, Server Identifier, and Identity Association to view Reply details.
* Observe the MAC addresses, IPv6 addresses, and lease time, as well as any options if included.
* Close Wireshark to complete this activity. Quit without Saving to discard the captured traffic.