diff --git a/pcap/flow.go b/pcap/flow.go
index b3a63743e2..bdb558457a 100644
--- a/pcap/flow.go
+++ b/pcap/flow.go
@@ -4,7 +4,6 @@ import (
 	"fmt"
 	"net"
 	"strconv"
-	"strings"
 )
 
 type Socket struct {
@@ -30,17 +29,16 @@ func (f Flow) String() string {
 }
 
 func ParseSocket(s string) (Socket, error) {
-	pair := strings.Split(s, ":")
-	if len(pair) == 2 {
-		ip := net.ParseIP(pair[0])
+	if host, port, err := net.SplitHostPort(s); err == nil {
+		ip := net.ParseIP(host)
 		if ip != nil {
-			port, err := strconv.Atoi(pair[1])
+			port, err := strconv.Atoi(port)
 			if err == nil {
 				return Socket{ip, port}, nil
 			}
 		}
 	}
-	return Socket{}, fmt.Errorf("address spec must have form ip:port (%s)", s)
+	return Socket{}, fmt.Errorf("address spec must have form ip4:port or [ip6]:port (%s)", s)
 }
 
 func ParseFlow(h0, h1 string) (Flow, error) {
diff --git a/tests/suite/pcap/test.go b/tests/suite/pcap/test.go
index cbb933c7af..b8d0b0b695 100644
--- a/tests/suite/pcap/test.go
+++ b/tests/suite/pcap/test.go
@@ -35,12 +35,12 @@ var out1 = `
 1425567047.804914
 `
 
-// 80.239.174.91.443 > 192.168.0.51.33773
+// 80.239.174.91.443 (aka [::ffff:50ef:ae5b]:443) > 192.168.0.51.33773
 
 // test simple flow extraction
 var Test2 = test.Shell{
 	Name:   "pcap-command",
-	Script: `pcap slice -r in.pcap 80.239.174.91:443 192.168.0.51:33773 | pcap ts -w out2`,
+	Script: `pcap slice -r in.pcap [::ffff:50ef:ae5b]:443 192.168.0.51:33773 | pcap ts -w out2`,
 	Input:  []test.File{test.File{Name: "in.pcap"}},
 	Expected: []test.File{
 		test.File{"out2", test.Trim(out2)},