The following are trace files (data files) used in the Hands-On Projects in Guide to TCP/IP: IPv6 and IPv4, Fifth Edition. Most of the trace files are in .pcapng format, although a few are .cap files, and all can be opened in Wireshark.
| File | Chapter | Description |
| ch03_IPv4Fields.pcapng | 3 | Contains IPv4 traffic that allows you to explore IPv4 headers. |
| ch03_IPv6Fields.pcapng | 3 | Contains IPv6 traffic that allows you to explore IPv6 headers and DHCPv6 traffic. |
| eigrp-for-ipv6-auth.pcap | 4 | Contains EIGRP routing protocol for IPv6 data. |
| ospf.cap | 4 | Contains OSPF routing protocol hello packet data. |
| RIP_v1 | 4 | Contains RIPv1 Request and RIPv1 Response packets. |
| ch05_ICMPv6_Echo_Reply.pcapng | 5 | Contains ICMPv6 Echo Request packets to an IPv6-capable local host, and ICMPv6 Echo Reply messages. |
| ch06_Hands-on_Project_trace_file.pcapng | 6 | Contains Router Solicitation, Router Advertisement, Neighbor Solicitation, and Neighbor Advertisement messages. |
| ch07_Hands-on_Project_trace_file_DHCPboot.pcapng | 7 | Shows the basic DHCP boot sequence, including the DHCP Discover, Offer, Request, and Acknowledgment. ARP is used to test two addresses before assigning one, and the DHCP client uses ARP to test the assigned address before using it. |
| ch07_Hands-on_Project_trace_file_DHCPboot2.pcapng | 7 | Contains some DHCP reconnect sequences. ICMP Echo packets are used to test addresses. |
| ch07_Hands-on_Project_trace_file_DHCPv6boot.pcapng | 7 | Contains messages exchanged between a client and a DHCPv6 server during the DHCPv6 boot sequence. |
| ch09_6to4.pcapng | 9 | Contains packets captured on a network using 6to4 for encapsulation. |
| ch09_TCP_handshake.pcapng | 9 | Contains the packet exchange involved between two nodes on a network involved in the TCP handshake process. |
| ch10_6to4.pcapng | 10 | Contains packets captured on a network using 6to4 for encapsulation. |
| ch10_isatap.pcapng | 10 | Contains Router Solicitation and Router Response transactions between a host and an ISATAP router using ISATAP interfaces. |
| ch10_Teredo.pcapng | 10 | Contains packets captured on a network using Teredo for encapsulation. |
| ch12_Arpscan.pcapng | 12 | Shows an ARP-based reconnaissance probe process. This ARP scan is probably generated by a program—the ARP queries are not generated manually. |
| ch12_Osscan.pcapng | 12 | Contains a TCP-based port scan (TCP reconnaissance probe) in which the scan is trying to determine the type of operating system clients are using. |
| ch12_Portscan.pcapng | 12 | Contains TCP reconnaissance probe process. |
| ch13_websitedown.pcapng | 13 | Contains network traffic that allows you to determine the cause of network latency. |
| ch13_chattyWindows10.pcapng | 13 | Contains network traffic sent from a Windows 10 computer to determine if it is compromised and sending information to a malicious destination. |
| ch14_Hands-on_Project_trace_file.pcapng | 14 | Contains Neighbor Discovery messages and Router Advertisements (RA); allows you to configure display filters to view RA messages. |