Creating an issue just because I think it'd be really nice to have an DHCPv6 analyzer. Possibly an interesting task to get into Spicy, Zeek scripting and a bit of Zeek cluster programming. Maybe someone out there would like to contribute this?

The following branch contains sketches of Spicy units, events and some notes that I had started years ago, but never picked up again. It wasn't all that great and likely needs a better/different structure.

https://github.com/zeek/zeek/tree/topic/awelzel/dhcpv6

Definitely not a requirement to base your work on this - feel free to start from scratch!

Just having a very basic dhcpv6.log would already be nice. It's always possible to iterate further and make it more complex later on.

Because from Zeek's perspective multiple connections are involved with DHCPv6, this will require some cluster-aware scripting to aggregate request/replies on the manager (or proxy) similar to what is done for DHCPv4 today.

The branch above contains a few PCAPs for basic testing:

testing/btest/Traces/dhcp/dhcpv6-freebsd-ntpservers.pcap
testing/btest/Traces/dhcp/dhcpv6-freebsd-rapid-commit.pcap
testing/btest/Traces/dhcp/dhcpv6-freebsd-vendorclass.pcap
testing/btest/Traces/dhcp/dhcpv6-wifi-rapidcommit.pcap