Suricata

do you have a pcap for that?

I think this is about using this notation in rules and config.

Do you have an example for that?

"nat64 notation" search finds this redmine entry as the only result.

Looking for nat64, this looks like a network address translation mechanism from IPv6 to IPv4, but in the end these are regular IPv6 and IPv4 address
There is a specific range/subnet of IPv6 adresses dedicated to this (as 10.0.0.0/8 is dedicated to local adresses)

Am I missing something ?