IETF RFC 9288
[ACTIVE]
Recommendations on the Filtering of IPv6 Packets Containing IPv6 Extension Headers at Transit Routers
Metadata
- Publisher
- IETF
- Doc Type
- Informational
- Pages
- 33
- Abstract
- This document analyzes the security implications of IPv6 Extension Headers and associated IPv6 options. Additionally, it discusses the operational and interoperability implications of discarding packets based on the IPv6 Extension Headers and IPv6 options they contain. Finally, it provides advice on the filtering of such IPv6 packets at transit routers for traffic not directed to them, for those cases where such filtering is deemed as necessary.
- Publication Date
- 2022-08-01
- Status Note
- Informational
- DOI
10.17487/RFC9288- Link
- https://doi.org/10.17487/RFC9288
- Author(s)
- Fernando GontWill (Shucheng) LIU
- Keyword(s)
- DoS, DDoS, ACL, Filtering Policy
Latest version of IETF RFC 9288
Document Versions — IETF RFC 9288
-
▶ IETF RFC 9288 (2022-08-01)THIS DOC [ACTIVE] [LATEST VERSION]
Normative Reference(s)
- IETF RFC 1034 [Active*]
- IETF RFC 2119 [Active*]
- IETF RFC 2205 [Active*]
- IETF RFC 2473 [Active*]
- IETF RFC 2675 [Active*]
- IETF RFC 2710 [Active*]
- IETF RFC 2711 [Active*]
- IETF RFC 3692 [Active*]
- IETF RFC 3810 [Superseded*]
- IETF RFC 4286 [Active*]
- IETF RFC 4301 [Active, Amended*]
- IETF RFC 4302 [Active*]
- IETF RFC 4303 [Active*]
- IETF RFC 4727 [Active*]
- IETF RFC 4782 [Active*]
- IETF RFC 5095 [Active*]
- IETF RFC 5533 [Active*]
- IETF RFC 5570 [Active*]
- IETF RFC 5971 [Active*]
- IETF RFC 6275 [Active*]
- IETF RFC 6398 [Active*]
- IETF RFC 6550 [Active*]
- IETF RFC 6553 [Active*]
- IETF RFC 6554 [Active*]
- IETF RFC 6621 [Active*]
- IETF RFC 6740 [Active*]
- IETF RFC 6744 [Active*]
- RFC6788 — RFC6788 EXTERNAL
- RFC6971 — RFC6971 EXTERNAL
- IETF RFC 7045 [Active*]
- IETF RFC 7112 [Active*]
- IETF RFC 7401 [Active*]
- IETF RFC 7731 [Active*]
- IETF RFC 8174 [Active*]
- IETF RFC 8200 [Active*]
- IETF RFC 8250 [Active*]
- IETF RFC 8754 [Active*]
- IETF RFC 8900 [Active*]
- IETF RFC 9008 [Active*]
Bibliographic Reference(s)
- IETF.draft-gont-6man-ipv6-opt-transmit-02 — I-D.gont-6man-ipv6-opt-transmit EXTERNAL
- IETF.draft-ietf-nimrod-eid-00 — NIMROD-EID EXTERNAL
- IETF.draft-irtf-pearg-numeric-ids-generation-11 — I-D.irtf-pearg-numeric-ids-generation EXTERNAL
- IETF.draft-vyncke-v6ops-james-02 — I-D.vyncke-v6ops-james EXTERNAL
- Biondi, P. and A. Ebalard, "IPv6 Routing Header Security", CanSecWest Security Conference, April 2007, <http://www.secdev.org/conf/IPv6_RH_security-csw07.pdf>. EXTERNAL
- Cisco Systems, "IPv6 Extension Headers Review and Considerations", Whitepaper, October 2006, <https://www.cisco.com/en/US/technologies/tk648/tk872/technologies_white_paper0900aecd8054d37d.pdf>. EXTERNAL
- Huston, G. and J. Damas, "IPv6 Fragmentation and EH Behaviours", IEPG Meeting at IETF 113", March 2022, <https://iepg.org/2022-03-20-ietf113/huston-v6frag.pdf>. EXTERNAL
- Zack, E., "Firewall Security Assessment and Benchmarking IPv6 Firewall Load Tests", IPv6 Hackers Meeting #1, Berlin, Germany, June 2013, <https://www.ipv6hackers.org/files/meetings/ipv6-hackers-1/zack-ipv6hackers1-firewall-security-assessment-and-benchmarking.pdf>. EXTERNAL
- IANA, "Internet Protocol Version 6 (IPv6) Parameters", <https://www.iana.org/assignments/ipv6-parameters>. EXTERNAL
- "Nimrod Documentation", <http://ana-3.lcs.mit.edu/~jnc/nimrod>. EXTERNAL
- IANA, "Protocol Numbers", <https://www.iana.org/assignments/protocol-numbers>. EXTERNAL
- IETF RFC 2460 [Superseded*]
- IETF RFC 3871 [Active*]
- IETF RFC 6192 [Active*]
- RFC7126 — RFC7126 EXTERNAL
- IETF RFC 7739 [Active*]
- IETF RFC 7872 [Active*]
- IETF RFC 9098 [Active*]
Source Data (JSON)
Full registry record with provenance metadata. Open directly: /api/doc/RFC9288.json
Reference Tree
Explore all references and references to this document, as a navigable tree.
Open Reference TreeReference this Doc
Plain text (ISO 690 compliant)
Preview:
IETF RFC 9288, Recommendations on the Filtering of IPv6 Packets Containing IPv6 Extension Headers at Transit Routers. Available at https://doi.org/10.17487/RFC9288
Snippet:
IETF RFC 9288, Recommendations on the Filtering of IPv6 Packets Containing IPv6 Extension Headers at Transit Routers. Available at https://doi.org/10.17487/RFC9288
HTML (ISO 690 compliant)
Preview:
IETF RFC 9288, Recommendations on the Filtering of IPv6 Packets Containing IPv6 Extension Headers at Transit Routers. Available at https://doi.org/10.17487/RFC9288
Snippet:
<span class="citation"><cite>IETF RFC 9288</cite>, Recommendations on the Filtering of IPv6 Packets Containing IPv6 Extension Headers at Transit Routers. Available at <a href="https://doi.org/10.17487/RFC9288" target="_blank" rel="noopener">https://doi.org/10.17487/RFC9288</a></span>
SMPTE's HTML Pub
Preview:
IETF RFC 9288, Recommendations on the Filtering of IPv6 Packets Containing IPv6 Extension Headers at Transit Routers
doi: 10.17487/RFC9288
url: https://doi.org/10.17487/RFC9288
doi: 10.17487/RFC9288
url: https://doi.org/10.17487/RFC9288
Snippet:
<li> <cite id="bib-rfc9288">IETF RFC 9288</cite>, Recommendations on the Filtering of IPv6 Packets Containing IPv6 Extension Headers at Transit Routers <span class="doi">10.17487/RFC9288</span> </li>
Referenced By
- IETF RFC 9673 [Active*]