Threats and surprises behind IPv6 extension headers

Luuk Hendriks, Petr Velan, Ricardo de Oliveira Schmidt, Pieter Tjerk De Boer, Aiko Pras

    Research output: Chapter in Book/Report/Conference proceedingConference contributionAcademicpeer-review

    5 Citations (Scopus)


    The concept of Extension Headers, newly introduced with IPv6, is elusive and enables new types of threats in the Internet. Simply dropping all traffic containing any Extension Header - a current practice by operators-seemingly is an effective solution, but at the cost of possibly dropping legitimate traffic as well. To determine whether threats indeed occur, and evaluate the actual nature of the traffic, measurement solutions need to be adapted. By implementing these specific parsing capabilities in flow exporters and performing measurements on two different production networks, we show it is feasible to quantify the metrics directly related to these threats, and thus allow for monitoring and detection. Analysing the traffic that is hidden behind Extension Headers, we find mostly benign traffic that directly affects end-user QoE: simply dropping all traffic containing Extension Headers is thus a bad practice with more consequences than operators might be aware of.
    Original languageEnglish
    Title of host publicationNetwork Traffic Measurement and Analysis Conference (TMA), 2017
    ISBN (Electronic)978-3-901882-95-1
    Publication statusPublished - 4 Aug 2017
    Event1st Network Traffic Measurement and Analysis Conference, TMA 2017 - Maynooth University, Dublin, Ireland
    Duration: 21 Jun 201723 Jun 2017
    Conference number: 1


    Conference1st Network Traffic Measurement and Analysis Conference, TMA 2017
    Abbreviated titleTMA 2017
    Internet address


    Dive into the research topics of 'Threats and surprises behind IPv6 extension headers'. Together they form a unique fingerprint.

    Cite this