Hi Jonathan,

Could you please provide file with traffic for analysis?

Thanks

From: Anna Norokh -X (anorokh - SOFTSERVE INC at Cisco) <anorokh@cisco.com>
Date: Tuesday, 6 January 2026 at 11:32
To: Viktor Chyzhovych -X (vchyzhov - SOFTSERVE INC at Cisco) <vchyzhov@cisco.com>
Subject: FW: [Snort-users] IPV six

Get Outlook for Mac

From: Snort-users <snort-users-bounces@lists.snort.org> on behalf of Jonathan Lee via Snort-users <snort-users@lists.snort.org>
Date: Friday, 5 December 2025 at 20:03
To: Joel Esler <eslerj@gmail.com>
Cc: Jonathan Lee via Snort-users <snort-users@lists.snort.org>
Subject: Re: [Snort-users] IPV six

Following up—does anyone else see this? App ID shows IPv6 entries, but the main rules barely log any, aside from a few scattered ones.
Attached for reference.

2025-12-03 21:50:15	TCP	2a02:6b8:a::a	443	2001:470:1f04:14::2	22968	1:1001193	Yandex
2025-12-03 21:50:16	TCP	2a02:6b8:a::a	443	2001:470:1f04:14::2	22968	1:1001193	Yandex
2025-12-03 21:50:16	TCP	2a02:6b8:a::a	443	2001:470:1f04:14::2	22968	1:1001193	Yandex
2025-12-03 21:50:16	TCP	2a02:6b8:a::a	443	2001:470:1f04:14::2	22968	1:1001193	Yandex
2025-12-03 21:50:16	TCP	2a02:6b8:a::a	443	2001:470:1f04:14::2	22968	1:1001193	Yandex
2025-12-03 21:50:14	TCP	2a02:6b8::244	443	2001:470:1f04:14::2	23967	1:1001193	Yandex
2025-12-03 21:50:14	TCP	2a02:6b8::244	443	2001:470:1f04:14::2	23967	1:1001193	Yandex
2025-12-03 21:50:14	TCP	2a02:6b8::244	443	2001:470:1f04:14::2	23967	1:1001193	Yandex
2025-12-03 21:50:15	TCP	2a02:6b8::244	443	2001:470:1f04:14::2	23967	1:1001193	Yandex
2025-12-03 21:50:16	TCP	2a02:6b8::244	443	2001:470:1f04:14::2	23967	1:1001193	Yandex
2025-12-03 21:50:17	TCP	2a02:6b8::244	443	2001:470:1f04:14::2	23967	1:1001193	Yandex
2025-12-03 21:50:19	TCP