Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

Why would ipv6 Loopback Adapter traffic be active?

Why would ipv6 Loopback Adapter traffic be active in Wireshark when I have the IPv6 disabled on my Windows 10 laptop and in my router. How can I use Wireshark to find the real device connecting to my computer, looking like it is my computer.

Thank you, Vtechie

Frame 7: 676 bytes on wire, 676 bytes captured on interface \Device\NPF_Loopback, id 0 Interface id: 0 (\Device\NPF_Loopback) Interface name: \Device\NPF_Loopback Encapsulation type: NULL/Loopback (15) Arrival Time: Jul 22, 2022 14:55:29.123198000 Central Daylight Time [Time shift for this packet: 0.000000000 seconds] [Time delta from previous captured frame: 1.198113000 seconds] [Time delta from previous displayed frame: 1.198113000 seconds] [Time since reference or first frame: 173.999209000 seconds] Frame Number: 7 Frame Length: 676 bytes (5408 bits) Capture Length: 676 bytes (5408 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: null:ipv6:udp:data] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Null/Loopback Family: IPv6 (24) Internet Protocol Version 6, Src: ::1 (::1), Dst: ff02::c (ff02::c) 0110 .... = Version: 6 <0110 .... = Version: 6 [This field makes the filter match on "ip.version == 6" possible]> .... 0000 0000 .... .... .... .... .... = Traffic Class: 0x00 (DSCP: CS0, ECN: Not-ECT) .... 0000 00.. .... .... .... .... .... = Differentiated Services Codepoint: Default (0) .... .... ..00 .... .... .... .... .... = Explicit Congestion Notification: Not ECN-Capable Transport (0) .... 1101 1111 1010 0001 1111 = Flow Label: 0xdfa1f Payload Length: 632 Next Header: UDP (17) Hop Limit: 1 Source Address: ::1 (::1) <source or="" destination="" address:="" ::1="" (::1)&gt;="" &lt;[source="" host:="" ::1]&gt;="" &lt;[source="" or="" destination="" host:="" ::1]&gt;="" destination="" address:="" ff02::c="" (ff02::c)="" <source="" or="" destination="" address:="" ff02::c="" (ff02::c)&gt;="" &lt;[destination="" host:="" ff02::c]&gt;="" &lt;[source="" or="" destination="" host:="" ff02::c]&gt;="" user="" datagram="" protocol,="" src="" port:="" 64625="" (64625),="" dst="" port:="" ws-discovery="" (3702)="" source="" port:="" 64625="" (64625)="" destination="" port:="" ws-discovery="" (3702)="" <source="" or="" destination="" port:="" 64625="" (64625)&gt;="" <source="" or="" destination="" port:="" ws-discovery="" (3702)&gt;="" length:="" 632="" checksum:="" 0x9cd5="" [correct]="" [calculated="" checksum:="" 0x9cd5]="" [checksum="" status:="" good]="" [stream="" index:="" 1]="" [timestamps]="" [time="" since="" first="" frame:="" 0.000000000="" seconds]="" [time="" since="" previous="" frame:="" 0.000000000="" seconds]="" udp="" payload="" (624="" bytes)="" data="" (624="" bytes)="" data:="" 3c="" 3f="" 78="" 6d="" 6c="" 20="" 76="" 65="" 72="" 73="" 69="" 6f="" 6e="" 3d="" 22="" 31="" 2e="" 30="" 22="" 20="" 65="" 6e="" 63="" 6f="" …="" text="" [truncated]:="" <?xml="" version="1.0" encoding="utf-8" ?="">

Why would ipv6 Loopback Adapter traffic be active?

Why would ipv6 Loopback Adapter traffic be active in Wireshark when I have the IPv6 disabled on my Windows 10 laptop and in my router. How can I use Wireshark to find the real device connecting to my computer, looking like it is my computer.

Thank you, Vtechie

Frame 7: 676 bytes on wire, 676 bytes captured on interface \Device\NPF_Loopback, id 0 Interface id: 0 (\Device\NPF_Loopback) Interface name: \Device\NPF_Loopback Encapsulation type: NULL/Loopback (15) Arrival Time: Jul 22, 2022 14:55:29.123198000 Central Daylight Time [Time shift for this packet: 0.000000000 seconds] [Time delta from previous captured frame: 1.198113000 seconds] [Time delta from previous displayed frame: 1.198113000 seconds] [Time since reference or first frame: 173.999209000 seconds] Frame Number: 7 Frame Length: 676 bytes (5408 bits) Capture Length: 676 bytes (5408 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: null:ipv6:udp:data] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Null/Loopback Family: IPv6 (24) Internet Protocol Version 6, Src: ::1 (::1), Dst: ff02::c (ff02::c) 0110 .... = Version: 6 <0110 .... = Version: 6 [This field makes the filter match on "ip.version == 6" possible]> .... 0000 0000 .... .... .... .... .... = Traffic Class: 0x00 (DSCP: CS0, ECN: Not-ECT) .... 0000 00.. .... .... .... .... .... = Differentiated Services Codepoint: Default (0) .... .... ..00 .... .... .... .... .... = Explicit Congestion Notification: Not ECN-Capable Transport (0) .... 1101 1111 1010 0001 1111 = Flow Label: 0xdfa1f Payload Length: 632 Next Header: UDP (17) Hop Limit: 1 Source Address: ::1 (::1) <source or="" destination="" address:="" ::1="" (::1)&gt;="" &lt;[source="" host:="" ::1]&gt;="" &lt;[source="" or="" destination="" host:="" ::1]&gt;="" destination="" address:="" ff02::c="" (ff02::c)="" <source="" or="" destination="" address:="" ff02::c="" (ff02::c)&gt;="" &lt;[destination="" host:="" ff02::c]&gt;="" &lt;[source="" or="" destination="" host:="" ff02::c]&gt;="" user="" datagram="" protocol,="" src="" port:="" 64625="" (64625),="" dst="" port:="" ws-discovery="" (3702)="" source="" port:="" 64625="" (64625)="" destination="" port:="" ws-discovery="" (3702)="" <source="" or="" destination="" port:="" 64625="" (64625)&gt;="" <source="" or="" destination="" port:="" ws-discovery="" (3702)&gt;="" length:="" 632="" checksum:="" 0x9cd5="" [correct]="" [calculated="" checksum:="" 0x9cd5]="" [checksum="" status:="" good]="" [stream="" index:="" 1]="" [timestamps]="" [time="" since="" first="" frame:="" 0.000000000="" seconds]="" [time="" since="" previous="" frame:="" 0.000000000="" seconds]="" udp="" payload="" (624="" bytes)="" data="" (624="" bytes)="" data:="" 3c="" 3f="" 78="" 6d="" 6c="" 20="" 76="" 65="" 72="" 73="" 69="" 6f="" 6e="" 3d="" 22="" 31="" 2e="" 30="" 22="" 20="" 65="" 6e="" 63="" 6f="" …="" text="" [truncated]:="" <?xml="" version="1.0" encoding="utf-8" ?="">

click to hide/show revision 3
None

Why would ipv6 Loopback Adapter traffic be active?

Why would ipv6 Loopback Adapter traffic be active in Wireshark when I have the IPv6 disabled on my Windows 10 laptop and in my router. How can I use Wireshark to find the real device connecting to my computer, looking like it is my computer.

Thank you, Vtechie

Frame 7: 676 bytes on wire, 676 bytes captured on interface \Device\NPF_Loopback, id 0 Interface id: 0 (\Device\NPF_Loopback) Interface name: \Device\NPF_Loopback Encapsulation type: NULL/Loopback (15) Arrival Time: Jul 22, 2022 14:55:29.123198000 Central Daylight Time [Time shift for this packet: 0.000000000 seconds] [Time delta from previous captured frame: 1.198113000 seconds] [Time delta from previous displayed frame: 1.198113000 seconds] [Time since reference or first frame: 173.999209000 seconds] Frame Number: 7 Frame Length: 676 bytes (5408 bits) Capture Length: 676 bytes (5408 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: null:ipv6:udp:data] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Null/Loopback Family: IPv6 (24) Internet Protocol Version 6, Src: ::1 (::1), Dst: ff02::c (ff02::c) 0110 .... = Version: 6 <0110 .... = Version: 6 [This field makes the filter match on "ip.version == 6" possible]> .... 0000 0000 .... .... .... .... .... = Traffic Class: 0x00 (DSCP: CS0, ECN: Not-ECT) .... 0000 00.. .... .... .... .... .... = Differentiated Services Codepoint: Default (0) .... .... ..00 .... .... .... .... .... = Explicit Congestion Notification: Not ECN-Capable Transport (0) .... 1101 1111 1010 0001 1111 = Flow Label: 0xdfa1f Payload Length: 632 Next Header: UDP (17) Hop Limit: 1 Source Address: ::1 (::1) <source or="" destination="" address:="" ::1="" (::1)&gt;="" &lt;[source="" host:="" ::1]&gt;="" &lt;[source="" or="" destination="" host:="" ::1]&gt;="" destination="" address:="" ff02::c="" (ff02::c)="" <source="" or="" destination="" address:="" ff02::c="" (ff02::c)&gt;="" &lt;[destination="" host:="" ff02::c]&gt;="" &lt;[source="" or="" destination="" host:="" ff02::c]&gt;="" user="" datagram="" protocol,="" src="" port:="" 64625="" (64625),="" dst="" port:="" ws-discovery="" (3702)="" source="" port:="" 64625="" (64625)="" destination="" port:="" ws-discovery="" (3702)="" <source="" or="" destination="" port:="" 64625="" (64625)&gt;="" <source="" or="" destination="" port:="" ws-discovery="" (3702)&gt;="" length:="" 632="" checksum:="" 0x9cd5="" [correct]="" [calculated="" checksum:="" 0x9cd5]="" [checksum="" status:="" good]="" [stream="" index:="" 1]="" [timestamps]="" [time="" since="" first="" frame:="" 0.000000000="" seconds]="" [time="" since="" previous="" frame:="" 0.000000000="" seconds]="" udp="" payload="" (624="" bytes)="" data="" (624="" bytes)="" data:="" 3c="" 3f="" 78="" 6d="" 6c="" 20="" 76="" 65="" 72="" 73="" 69="" 6f="" 6e="" 3d="" 22="" 31="" 2e="" 30="" 22="" 20="" 65="" 6e="" 63="" 6f="" …="" text="" [truncated]:="" <?xml="" <Source or Destination Address: ::1 (::1)> <[Source Host: ::1]> <[Source or Destination Host: ::1]> Destination Address: ff02::c (ff02::c) <Source or Destination Address: ff02::c (ff02::c)> <[Destination Host: ff02::c]> <[Source or Destination Host: ff02::c]> User Datagram Protocol, Src Port: 64625 (64625), Dst Port: ws-discovery (3702) Source Port: 64625 (64625) Destination Port: ws-discovery (3702) <Source or Destination Port: 64625 (64625)> <Source or Destination Port: ws-discovery (3702)> Length: 632 Checksum: 0x9cd5 [correct] [Calculated Checksum: 0x9cd5] [Checksum Status: Good] [Stream index: 1] [Timestamps] [Time since first frame: 0.000000000 seconds] [Time since previous frame: 0.000000000 seconds] UDP payload (624 bytes) Data (624 bytes) Data: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f … Text [truncated]: <?xml version="1.0" encoding="utf-8" ?="">encoding="utf-8"?><soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope" xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/08/addressing" xmlns:wsd="http://schemas.xmlsoap.org/ws/2005/04/disc [Payload MD5 hash: a596eeb26945f308e2d25d79d9e40413] [Length: 624]

click to hide/show revision 4
None

Why would ipv6 Loopback Adapter traffic be active?

Why would ipv6 Loopback Adapter traffic be active in Wireshark when I have the IPv6 disabled on my Windows 10 laptop and in my router. How can I use Wireshark to find the real device connecting to my computer, looking like it is my computer.

Thank you, Vtechie

 Frame 7: 676 bytes on wire, 676 bytes captured on interface \Device\NPF_Loopback, id 0
    Interface id: 0 (\Device\NPF_Loopback)
        Interface name: \Device\NPF_Loopback
    Encapsulation type: NULL/Loopback (15)
    Arrival Time: Jul 22, 2022 14:55:29.123198000 Central Daylight Time
    [Time shift for this packet: 0.000000000 seconds]
    [Time delta from previous captured frame: 1.198113000 seconds]
    [Time delta from previous displayed frame: 1.198113000 seconds]
    [Time since reference or first frame: 173.999209000 seconds]
    Frame Number: 7
    Frame Length: 676 bytes (5408 bits)
    Capture Length: 676 bytes (5408 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: null:ipv6:udp:data]
    [Coloring Rule Name: UDP]
    [Coloring Rule String: udp]
Null/Loopback
    Family: IPv6 (24)
Internet Protocol Version 6, Src: ::1 (::1), Dst: ff02::c (ff02::c)
    0110 .... = Version: 6
    <0110 .... = Version: 6 [This field makes the filter match on "ip.version == 6" possible]>
    .... 0000 0000 .... .... .... .... .... = Traffic Class: 0x00 (DSCP: CS0, ECN: Not-ECT)
        .... 0000 00.. .... .... .... .... .... = Differentiated Services Codepoint: Default (0)
        .... .... ..00 .... .... .... .... .... = Explicit Congestion Notification: Not ECN-Capable Transport (0)
    .... 1101 1111 1010 0001 1111 = Flow Label: 0xdfa1f
    Payload Length: 632
    Next Header: UDP (17)
    Hop Limit: 1
    Source Address: ::1 (::1)
    <Source or Destination Address: ::1 (::1)>
    <[Source Host: ::1]>
    <[Source or Destination Host: ::1]>
    Destination Address: ff02::c (ff02::c)
    <Source or Destination Address: ff02::c (ff02::c)>
    <[Destination Host: ff02::c]>
    <[Source or Destination Host: ff02::c]>
User Datagram Protocol, Src Port: 64625 (64625), Dst Port: ws-discovery (3702)
    Source Port: 64625 (64625)
    Destination Port: ws-discovery (3702)
    <Source or Destination Port: 64625 (64625)>
    <Source or Destination Port: ws-discovery (3702)>
    Length: 632
    Checksum: 0x9cd5 [correct]
        [Calculated Checksum: 0x9cd5]
    [Checksum Status: Good]
    [Stream index: 1]
    [Timestamps]
        [Time since first frame: 0.000000000 seconds]
        [Time since previous frame: 0.000000000 seconds]
    UDP payload (624 bytes)
Data (624 bytes)
    Data: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f …
    Text [truncated]: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope" xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/08/addressing" xmlns:wsd="http://schemas.xmlsoap.org/ws/2005/04/disc
    [Payload MD5 hash: a596eeb26945f308e2d25d79d9e40413]
    [Length: 624]