In a raw IPv6 packet dump, how do you confirm it's IPv6 from the very first byte?

The first nibble (first hex digit) is the Version field — 6 means IPv6. A leading byte of 60 is 0110 0000: version 6, with zero traffic class/flow label.

Reading a hex dump, remember one hex digit = 4 bits:

• The header's first 4 bits are the Version field
• A first byte of 60 → 6 = 0110 binary = version 6 ✓ (the following 0 starts the all-zero Traffic Class / Flow Label)
• Then Payload Length appears as 2 bytes — e.g. 00 3c hex = 60 decimal bytes of payload
• Next Header is the following byte — e.g. 11 hex = 17 decimal = UDP
• Hop Limit next — e.g. 01 means the packet may travel only one hop (link-local only)

Tip: First nibble 4 → IPv4, first nibble 6 → IPv6. It's the fastest way to identify the IP version when staring at raw bytes.

Go deeper:

• Wireshark in IP version 6 (insinuator.net / ERNW) — practical filters, columns and colouring for dissecting IPv6 packets and RA flags in a capture.