Dear All, I was able to diagnose and resolve the issue with Miredo on Yosemite. I am writing it up; the gist of it is that the tunnel device as opened by miredo requires an extra header, which Scapy does not supply. To give you a quick heads-up: miredo expects a 4-byte header for the "family" of the packet being sent. For IPv6 it's 00 00 00 1e. Accordingly, a way to send an ICMPv6 packet with the body of 'sergey', you need to: 0. Run miredo and be able to ping6 a remote address---to make sure miredo works. See task5.txt Note the virtual interface miredo creates. For me it's tun0 . Run Wireshark on tun0 , see the echo requests and responses as IPv6 packets. Note the little Null/Loopback layer in Wireshark's middle frame. 1. In Scapy, create the raw header: >>> fh = Raw(load='\x00\x00\x00\x1e') [checking it:] >>> fh >>> hexdump(fh) 0000 00 00 00 1E 2. Use sendp() to send this header with your packet ICMPv6 packet. You have to use sendp(), because send() will attempt to attach an Ethernet header to your IPv6 packet, which will confuse miredo. [creating an ICMPv6 echo request, checking that it's correct:] >>> p = IPv6(dst='2604:5f00:ffff:fe00::1:53')/ICMPv6EchoRequest(data='sergey') >>> p > [Sending. Note the specific interface 'tun0'. Also, note that I send this 3 times; the first packet fails, due to a timeout inside miredo.] >>> sendp( fh/p , iface='tun0', count = 3) ... Sent 3 packets. [In Wireshark, two echo reply packets arrive from test6.] -------------------------------------------------------------- You can observe the responses in Wireshark, but it helps to see them in Scapy. Here is the trick for doing it. In a separate root shell, I started Scapy and ran it in a sniffing loop using the sniff() function on the tun0 interface. Packets coming back from test6 in response to my ICMPv6 echo requests will show up, but they will have the same 4-byte header that confuses Scapy, causing it to print the "WARNING: more Unable to guess datalink type (interface=tun0 linktype=0). Using Raw" warning. Luckily, sniff() allows you to define a custom callback function to parse and print the packet; mine strips these 4 bytes first, then tells Scapy to interpret the rest as IPv6: bash-3.2# scapy INFO: Can't import PyX. Won't be able to use psdump() or pdfdump(). Welcome to Scapy (2.3.1) >>> def cb(pkt): print IPv6(str(pkt)[4:]).show() ... >>> sniff(iface='tun0', prn=cb) [Sniff waits for packets, both incoming and outgoing on tun0.] [Note that the 'prn' callback gets a packet that Scapy has already tried to guess the format of and parse, hence the warning. I convert this packet pkt back to a string of bytes with str(), strip the first 4, and re-parse the rest.] Now in my other Scapy window, I make and send the echo request packet: >>> s = IPv6(dst='2604:5f00:ffff:fe00::1:53')/ICMPv6EchoRequest(data='sergey') >>> sendp( '\x00\x00\x00\x1e'/s, iface='tun0', count=3) ... Sent 3 packets. Back in my sniffing window I see: WARNING: Unable to guess datalink type (interface=tun0 linktype=0). Using Raw ###[ IPv6 ]### version= 6L tc= 0L fl= 0L plen= 14 nh= ICMPv6 hlim= 64 src= 2001::53aa:64c:1418:3ed1:b800:57b7 [Teredo srv: 83.170.6.76 cli: 71.255.168.72:49454] dst= 2604:5f00:ffff:fe00::1:53 ###[ ICMPv6 Echo Request ]### type= Echo Request code= 0 cksum= 0xd47e id= 0x0 seq= 0x0 data= 'sergey' None WARNING: Unable to guess datalink type (interface=tun0 linktype=0). Using Raw ###[ IPv6 ]### version= 6L tc= 0L fl= 0L plen= 14 nh= ICMPv6 hlim= 64 src= 2001::53aa:64c:1418:3ed1:b800:57b7 [Teredo srv: 83.170.6.76 cli: 71.255.168.72:49454] dst= 2604:5f00:ffff:fe00::1:53 ###[ ICMPv6 Echo Request ]### type= Echo Request code= 0 cksum= 0xd47e id= 0x0 seq= 0x0 data= 'sergey' None WARNING: more Unable to guess datalink type (interface=tun0 linktype=0). Using Raw ###[ IPv6 ]### version= 6L tc= 0L fl= 0L plen= 14 nh= ICMPv6 hlim= 64 src= 2001::53aa:64c:1418:3ed1:b800:57b7 [Teredo srv: 83.170.6.76 cli: 71.255.168.72:49454] dst= 2604:5f00:ffff:fe00::1:53 ###[ ICMPv6 Echo Request ]### type= Echo Request code= 0 cksum= 0xd47e id= 0x0 seq= 0x0 data= 'sergey' None ###[ IPv6 ]### version= 6L tc= 0L fl= 0L plen= 14 nh= ICMPv6 hlim= 58 src= 2604:5f00:ffff:fe00::1:53 dst= 2001::53aa:64c:1418:3ed1:b800:57b7 [Teredo srv: 83.170.6.76 cli: 71.255.168.72:49454] ###[ ICMPv6 Echo Reply ]### type= Echo Reply code= 0 cksum= 0xd37e id= 0x0 seq= 0x0 data= 'sergey' None ###[ IPv6 ]### version= 6L tc= 0L fl= 0L plen= 14 nh= ICMPv6 hlim= 58 src= 2604:5f00:ffff:fe00::1:53 dst= 2001::53aa:64c:1418:3ed1:b800:57b7 [Teredo srv: 83.170.6.76 cli: 71.255.168.72:49454] ###[ ICMPv6 Echo Reply ]### type= Echo Reply code= 0 cksum= 0xd37e id= 0x0 seq= 0x0 data= 'sergey' None Note that there are only two Reply packets. The first one was lost while miredo was making the connection. But now if I repeat the sendp() command quickly, I will have all three replied to. To see this, I shorten the printed message. Pressing Ctrl+C in the sniffing window, I get back my prompt, then re-define the callback function cb: ^C >>> def cb(pkt): print IPv6(str(pkt)[4:]).summary() ... >>> Then I start the sniff loop again: >>> sniff(iface='tun0', prn=cb) Now in the Scapy shell where I make my packets: >>> sendp( '\x00\x00\x00\x1e'/s, iface='tun0', count=3) ... Sent 3 packets. WARNING: Unable to guess datalink type (interface=tun0 linktype=0). Using Raw IPv6 / ICMPv6 Echo Request (id: 0x0 seq: 0x0) WARNING: Unable to guess datalink type (interface=tun0 linktype=0). Using Raw IPv6 / ICMPv6 Echo Request (id: 0x0 seq: 0x0) WARNING: Unable to guess datalink type (interface=tun0 linktype=0). Using Raw IPv6 / ICMPv6 Echo Request (id: 0x0 seq: 0x0) IPv6 / ICMPv6 Echo Reply (id: 0x0 seq: 0x0) IPv6 / ICMPv6 Echo Reply (id: 0x0 seq: 0x0) IPv6 / ICMPv6 Echo Reply (id: 0x0 seq: 0x0) Now all three requests are replied to. Note that you may get some ICMPv6TimeExceeded packets resulting from your previous sending attempts. This happens in IPv6 tunnels.