diff --git a/tests/nexus/verify_1_2_LP_5_3_8.py b/tests/nexus/verify_1_2_LP_5_3_8.py
index d8a91c075..e94cbe4e1 100644
--- a/tests/nexus/verify_1_2_LP_5_3_8.py
+++ b/tests/nexus/verify_1_2_LP_5_3_8.py
@@ -109,20 +109,20 @@ def verify(pv):
     _pkt = pkts.filter_ping_request().\
         filter_wpan_src64(ROUTER_1).\
         filter_wpan_dst16(SSED_1_RLOC16).\
-        filter(lambda p: p.wpan_tap.ch_num == PRIMARY_CHANNEL).\
+        filter(lambda p: p.wpan.channel == PRIMARY_CHANNEL).\
         must_next()
 
     pkts.range(checkpoint, pkts.index).\
         filter_wpan_src64(SSED_1).\
         filter_wpan_dst16(ROUTER_1_RLOC16).\
         filter_wpan_cmd(consts.WPAN_DATA_REQUEST).\
-        filter(lambda p: p.wpan_tap.ch_num == PRIMARY_CHANNEL).\
+        filter(lambda p: p.wpan.channel == PRIMARY_CHANNEL).\
         must_not_next()
 
     pkts.filter_ping_reply(identifier=_pkt.icmpv6.echo.identifier).\
         filter_wpan_src64(SSED_1).\
         filter_wpan_dst16(ROUTER_1_RLOC16).\
-        filter(lambda p: p.wpan_tap.ch_num == PRIMARY_CHANNEL).\
+        filter(lambda p: p.wpan.channel == PRIMARY_CHANNEL).\
         must_next()
 
     checkpoint = pkts.index
@@ -136,7 +136,7 @@ def verify(pv):
     pkts.filter_wpan_src64(SSED_1).\
         filter_wpan_dst64(ROUTER_1).\
         filter_mle_cmd(consts.MLE_CHILD_UPDATE_REQUEST).\
-        filter(lambda p: CSL_CHANNEL_TLV in p.mle.tlv.type and p.wpan_tap.ch_num == PRIMARY_CHANNEL).\
+        filter(lambda p: CSL_CHANNEL_TLV in p.mle.tlv.type and p.wpan.channel == PRIMARY_CHANNEL).\
         must_next()
 
     # Step 5: Router_1 (DUT)
@@ -148,7 +148,7 @@ def verify(pv):
     pkts.filter_wpan_src64(ROUTER_1).\
         filter_wpan_dst64(SSED_1).\
         filter_mle_cmd(consts.MLE_CHILD_UPDATE_RESPONSE).\
-        filter(lambda p: p.wpan_tap.ch_num == SECONDARY_CHANNEL).\
+        filter(lambda p: p.wpan.channel == SECONDARY_CHANNEL).\
         must_next()
 
     # Step 6: Harness
@@ -168,20 +168,20 @@ def verify(pv):
     _pkt = pkts.filter_ping_request().\
         filter_wpan_src64(ROUTER_1).\
         filter_wpan_dst16(SSED_1_RLOC16).\
-        filter(lambda p: p.wpan_tap.ch_num == SECONDARY_CHANNEL).\
+        filter(lambda p: p.wpan.channel == SECONDARY_CHANNEL).\
         must_next()
 
     pkts.range(checkpoint, pkts.index).\
         filter_wpan_src64(SSED_1).\
         filter_wpan_dst16(ROUTER_1_RLOC16).\
         filter_wpan_cmd(consts.WPAN_DATA_REQUEST).\
-        filter(lambda p: p.wpan_tap.ch_num == SECONDARY_CHANNEL).\
+        filter(lambda p: p.wpan.channel == SECONDARY_CHANNEL).\
         must_not_next()
 
     pkts.filter_ping_reply(identifier=_pkt.icmpv6.echo.identifier).\
         filter_wpan_src64(SSED_1).\
         filter_wpan_dst16(ROUTER_1_RLOC16).\
-        filter(lambda p: p.wpan_tap.ch_num == PRIMARY_CHANNEL).\
+        filter(lambda p: p.wpan.channel == PRIMARY_CHANNEL).\
         must_next()
 
     checkpoint = pkts.index
@@ -196,7 +196,7 @@ def verify(pv):
     pkts.filter_wpan_src64(SSED_1).\
         filter_wpan_dst64(ROUTER_1).\
         filter_mle_cmd(consts.MLE_CHILD_UPDATE_REQUEST).\
-        filter(lambda p: CSL_CHANNEL_TLV in p.mle.tlv.type and p.wpan_tap.ch_num == PRIMARY_CHANNEL).\
+        filter(lambda p: CSL_CHANNEL_TLV in p.mle.tlv.type and p.wpan.channel == PRIMARY_CHANNEL).\
         must_next()
 
     # Step 9: Router_1 (DUT)
@@ -208,7 +208,7 @@ def verify(pv):
     pkts.filter_wpan_src64(ROUTER_1).\
         filter_wpan_dst64(SSED_1).\
         filter_mle_cmd(consts.MLE_CHILD_UPDATE_RESPONSE).\
-        filter(lambda p: p.wpan_tap.ch_num == PRIMARY_CHANNEL).\
+        filter(lambda p: p.wpan.channel == PRIMARY_CHANNEL).\
         must_next()
 
     # Step 10: Harness
@@ -228,20 +228,20 @@ def verify(pv):
     _pkt = pkts.filter_ping_request().\
         filter_wpan_src64(ROUTER_1).\
         filter_wpan_dst16(SSED_1_RLOC16).\
-        filter(lambda p: p.wpan_tap.ch_num == PRIMARY_CHANNEL).\
+        filter(lambda p: p.wpan.channel == PRIMARY_CHANNEL).\
         must_next()
 
     pkts.range(checkpoint, pkts.index).\
         filter_wpan_src64(SSED_1).\
         filter_wpan_dst16(ROUTER_1_RLOC16).\
         filter_wpan_cmd(consts.WPAN_DATA_REQUEST).\
-        filter(lambda p: p.wpan_tap.ch_num == PRIMARY_CHANNEL).\
+        filter(lambda p: p.wpan.channel == PRIMARY_CHANNEL).\
         must_not_next()
 
     pkts.filter_ping_reply(identifier=_pkt.icmpv6.echo.identifier).\
         filter_wpan_src64(SSED_1).\
         filter_wpan_dst16(ROUTER_1_RLOC16).\
-        filter(lambda p: p.wpan_tap.ch_num == PRIMARY_CHANNEL).\
+        filter(lambda p: p.wpan.channel == PRIMARY_CHANNEL).\
         must_next()
 
     checkpoint = pkts.index
@@ -263,7 +263,7 @@ def verify(pv):
     _pkt = pkts.filter_ping_request().\
         filter_wpan_src64(ROUTER_1).\
         filter_wpan_dst16(SSED_1_RLOC16).\
-        filter(lambda p: p.wpan_tap.ch_num == TERNARY_CHANNEL).\
+        filter(lambda p: p.wpan.channel == TERNARY_CHANNEL).\
         must_next()
 
     # Pass Criteria 13.2: SSED_1 MUST NOT send a MAC Data Request prior to receiving the ICMPv6 Echo Request.
@@ -274,13 +274,13 @@ def verify(pv):
         filter_wpan_src64(SSED_1).\
         filter_wpan_dst16(ROUTER_1_RLOC16).\
         filter_wpan_cmd(consts.WPAN_DATA_REQUEST).\
-        filter(lambda p: p.wpan_tap.ch_num == TERNARY_CHANNEL).\
+        filter(lambda p: p.wpan.channel == TERNARY_CHANNEL).\
         must_not_next()
 
     pkts.filter_ping_reply(identifier=_pkt.icmpv6.echo.identifier).\
         filter_wpan_src64(SSED_1).\
         filter_wpan_dst16(ROUTER_1_RLOC16).\
-        filter(lambda p: p.wpan_tap.ch_num == TERNARY_CHANNEL).\
+        filter(lambda p: p.wpan.channel == TERNARY_CHANNEL).\
         must_next()
 
 
diff --git a/tests/nexus/verify_utils.py b/tests/nexus/verify_utils.py
index 40f6b3732..9d44018be 100644
--- a/tests/nexus/verify_utils.py
+++ b/tests/nexus/verify_utils.py
@@ -223,7 +223,7 @@ def apply_patches():
     layer_fields._get_candidate_layers = patched_get_candidate_layers
 
     # Patch Layer.get_field to handle wpan_tap.ch_num
-    from pyshark.packet.layer import Layer
+    from pyshark.packet.layers.base import BaseLayer as Layer
     old_get_field = Layer.get_field
 
     def patched_get_field(self, name):
diff --git a/tests/scripts/thread-cert/pktverify/layers.py b/tests/scripts/thread-cert/pktverify/layers.py
index e8e3f38a8..ac083f8c7 100644
--- a/tests/scripts/thread-cert/pktverify/layers.py
+++ b/tests/scripts/thread-cert/pktverify/layers.py
@@ -30,7 +30,7 @@ import logging
 from typing import Optional
 
 from pyshark.packet.fields import LayerField, LayerFieldsContainer
-from pyshark.packet.layer import Layer as RawLayer
+from pyshark.packet.layers.base import BaseLayer as RawLayer
 from pyshark.packet.packet import Packet as RawPacket
 
 from pktverify.layer_fields import get_layer_field, check_layer_field_exists
diff --git a/tests/scripts/thread-cert/pktverify/packet.py b/tests/scripts/thread-cert/pktverify/packet.py
index 4dd4facee..b80449e1a 100644
--- a/tests/scripts/thread-cert/pktverify/packet.py
+++ b/tests/scripts/thread-cert/pktverify/packet.py
@@ -30,7 +30,7 @@ import logging
 import sys
 from typing import Iterable, List, Union, Callable
 
-from pyshark.packet.layer import Layer as RawLayer
+from pyshark.packet.layers.base import BaseLayer as RawLayer
 from pyshark.packet.packet import Packet as RawPacket
 
 from pktverify import errors
diff --git a/tests/scripts/thread-cert/requirements.in b/tests/scripts/thread-cert/requirements.in
index 3cac2686c..84def4e76 100644
--- a/tests/scripts/thread-cert/requirements.in
+++ b/tests/scripts/thread-cert/requirements.in
@@ -1,4 +1,4 @@
 ipaddress
 pexpect
 pycryptodome
-pyshark==0.4.6
+pyshark==0.6
diff --git a/tests/scripts/thread-cert/requirements.txt b/tests/scripts/thread-cert/requirements.txt
index 834b131c7..f4e3f1b8b 100644
--- a/tests/scripts/thread-cert/requirements.txt
+++ b/tests/scripts/thread-cert/requirements.txt
@@ -18,5 +18,5 @@ py==1.11.0
     # via pyshark
 pycryptodome==3.19.1
     # via -r requirements.in
-pyshark==0.4.6
+pyshark==0.6
     # via -r requirements.in