Recommendations on Filtering of IPv4 Packets Containing IPv4 Options

Metadata

Publisher: IETF
Doc Type: Best Practice
Pages: 36
Abstract: This document provides advice on the filtering of IPv4 packets based on the IPv4 options they contain. Additionally, it discusses the operational and interoperability implications of dropping packets based on the IP options they contain.
Publication Date: 2014-02-01
Status Note: Best Current Practice
DOI: 10.17487/RFC7126
Link: https://doi.org/10.17487/RFC7126
Author(s): Fernando Gont
Ran Atkinson
Carlos Pignataro

Latest version of IETF RFC 7126

Document Versions — IETF RFC 7126

▶ IETF RFC 7126 (2014-02-01)

THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

IETF RFC 791 [Active*]
IETF RFC 1122 [Active*]
IETF RFC 1191 [Active*]
IETF RFC 1812 [Active*]
IETF RFC 2113 [Active*]
IETF RFC 2119 [Active*]
IETF RFC 4727 [Active*]
IETF RFC 4821 [Active*]
IETF RFC 5015 [Active*]
IETF RFC 6398 [Active*]
IETF RFC 6814 [Active*]

Bibliographic Reference(s)

NIST.FIPS.188 — FP188 EXTERNAL
Biondi, P. and A. Ebalard, "IPv6 Routing Header Security", CanSecWest 2007 Security Conference, 2007, < http://www.secdev.org/conf/IPv6_RH_security-csw07.pdf >. EXTERNAL
Kohno, T., Broido, A., and kc. Claffy, "Remote Physical Device Fingerprinting", IEEE Transactions on Dependable and Secure Computing, Vol. 2, No. 2, 2005. EXTERNAL
National Security Agency (United States), "Security- Enhanced Linux - NSA/CSS", January 2009, < http://www.nsa.gov/research/selinux/index.shtml >. EXTERNAL
Landwehr, C., "Formal Models for Computer Security", ACM Computing Surveys, Vol. 13, No. 3, Association for Computing Machinery, New York, NY, USA, September 1981. EXTERNAL
IETF CIPSO Working Group, "COMMERCIAL IP SECURITY OPTION (CIPSO 2.2)", Work in Progress, 1992. EXTERNAL
Fonseca, R., Porter, G., Katz, R., Shenker, S., and I. Stoica, "IP Options are not an option", EECS Department, University of California, Berkeley, December 2005, < http://www.eecs.berkeley.edu/Pubs/TechRpts/2005/ EECS-2005-24.html >. EXTERNAL
Bremier-Barr, A. and H. Levy, "Spoofing prevention method", Proceedings of IEEE InfoCom 2005, Volume 1, pp. 536-547, March 2005. EXTERNAL
Microsoft, "Microsoft Security Program: Microsoft Security Bulletin (MS99-038). Patch Available for "Spoofed Route Pointer" Vulnerability", September 1999, < http://www.microsoft.com/technet/security/bulletin/ ms99-038.mspx >. EXTERNAL
Estrin, D. and D. Farinacci, "Bi-Directional Shared Trees in PIM-SM", Work in Progress, May 1999. EXTERNAL
Cisco Systems, Inc., "IP Security Options Commands", Cisco IOS Security Command Reference, Release 12.2, < http://www.cisco.com/en/US/docs/ios/12_2/security/ command/reference/srfipso.html >. EXTERNAL
Stoica, I., Zhang, H., Venkitaram, N., and J. Mysore, "Per Hop Behaviors Based on Dynamic Packet State", Work in Progress, October 2002. EXTERNAL
Cisco Systems, Inc., "Configuring IP Security Options", Cisco IOS Security Configuration Guide, Release 12.2, 2006, < http://www.cisco.com/en/US/docs/ios/12_2/security/ configuration/guide/scfipso.html >. EXTERNAL
OpenBSD, "OpenBSD Security Advisory: IP Source Routing Problem", February 1998, < http://www.openbsd.org/advisories/sourceroute.txt >. EXTERNAL
"Solaris Trusted Extensions: Labeled Security for Absolute Protection", 2008, < http://www.oracle.com/technetwork/server-storage/ solaris10/overview/trusted-extensions-149944.pdf >. EXTERNAL
Gont, F., "Security Assessment of the Internet Protocol", 2008, < http://www.gont.com.ar/papers/InternetProtocol.pdf >. EXTERNAL
IANA, "IP OPTION NUMBERS", < http://www.iana.org/assignments/ip-parameters >. EXTERNAL
IETF CIPSO Working Group, "Commercial Internet Protocol Security Option (CIPSO) Charter", 1994, < http://www.ietf.org/proceedings/94jul/charters/ cipso-charter.html >. EXTERNAL
Medina, A., Allman, M., and S. Floyd, "Measuring Interactions Between Transport Protocols and Middleboxes", Proc. 4th ACM SIGCOMM/USENIX Conference on Internet Measurement, October 2004. EXTERNAL
IRIX, "IRIX 6.5 trusted_networking(7) manual page", 2008, < http://techpubs.sgi.com/library/tpl/cgi-bin/ getdoc.cgi?coll=0650&db=man&fname=/usr/share/catman/a_man/ cat7/trusted_networking.z>. EXTERNAL
IETF RFC 1038 [Superseded*]
IETF RFC 1063 [Superseded*]
IETF RFC 1108 [Active*]
IETF RFC 1385 [Superseded*]
IETF RFC 1393 [Superseded*]
IETF RFC 1475 [Superseded*]
IETF RFC 1770 [Superseded*]
IETF RFC 2205 [Active*]
IETF RFC 2407 [Superseded*]
IETF RFC 3585 [Active*]
IETF RFC 4306 [Superseded*]
IETF RFC 4782 [Active*]
IETF RFC 4807 [Active*]
IETF RFC 4949 [Active*]
IETF RFC 5350 [Active*]
IETF RFC 5570 [Active*]
IETF RFC 5996 [Superseded*]
IETF RFC 6192 [Active*]
IETF RFC 6274 [Active*]

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC7126.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree

Reference this Doc

Plain text (ISO 690 compliant)

Preview:

IETF RFC 7126, Recommendations on Filtering of IPv4 Packets Containing IPv4 Options. Available at https://doi.org/10.17487/RFC7126

Snippet:

IETF RFC 7126, Recommendations on Filtering of IPv4 Packets Containing IPv4 Options. Available at https://doi.org/10.17487/RFC7126

HTML (ISO 690 compliant)

Preview:

IETF RFC 7126, Recommendations on Filtering of IPv4 Packets Containing IPv4 Options. Available at https://doi.org/10.17487/RFC7126

Snippet:

<span class="citation"><cite>IETF RFC 7126</cite>, Recommendations on Filtering of IPv4 Packets Containing IPv4 Options. Available at <a href="https://doi.org/10.17487/RFC7126" target="_blank" rel="noopener">https://doi.org/10.17487/RFC7126</a></span>

SMPTE's HTML Pub

Preview:

IETF RFC 7126, Recommendations on Filtering of IPv4 Packets Containing IPv4 Options
doi: 10.17487/RFC7126
url: https://doi.org/10.17487/RFC7126

Snippet:

<li>
<cite id="bib-rfc7126">IETF RFC 7126</cite>, Recommendations on Filtering of IPv4 Packets Containing IPv4 Options
<span class="doi">10.17487/RFC7126</span>
</li>

Referenced By

IETF RFC 9065 [Active*]
IETF RFC 9288 [Active*]