IPv6 source routing is a packet-routing feature that lets the sender specify part of the path an IPv6 packet should follow. It uses extension headers to define routing steps, which can affect forwarding behaviour and is often restricted or filtered for security reasons.
How IPv6 Source Routing Works
IPv6 source routing allows the sender to influence the path a packet takes by placing routing information in extension headers. That makes forwarding behaviour partly dependent on sender-supplied instructions rather than only on ordinary routing tables and hop-by-hop decisions.
In practice, the feature sits inside the IPv6 extension-header model, so it is closer to a packet-handling capability than to a general routing policy. Because the packet itself can carry path directives, the receiving network must decide whether to honour, ignore, or block them.
Why IPv6 Source Routing Is Sensitive
Source routing is sensitive because it can bypass the assumptions that perimeter filters, path controls, and segmentation normally make about how traffic should enter and traverse a network. The ability to steer a packet can also expose intermediate hops, create unexpected forwarding patterns, or confuse devices that do not inspect IPv6 extension headers consistently.
Many environments treat this feature as undesirable for routine traffic, especially where predictable path enforcement matters. The IPv6 Security Guide covers related first-hop controls, neighbour discovery protection, and IPv6 monitoring practices that are often used when organisations reduce this kind of exposure.
Operational Controls for IPv6 Networks
Administrators typically manage this feature by deciding whether it should be permitted at all, then enforcing that decision at routers, firewalls, and other packet filters. In many enterprises, the control objective is not to use source routing for business traffic, but to prevent untrusted packets from carrying path instructions into sensitive segments.
Operationally, the important question is whether devices consistently inspect IPv6 extension headers and apply the intended policy. If some security appliances ignore the headers while others process them, traffic can behave differently at different points in the path.
Visibility, Filtering, and Troubleshooting
IPv6 source routing can complicate both detection and troubleshooting because the packet path may no longer match the path operators expect from topology alone. That makes packet captures, firewall logs, router counters, and segmentation policy review more important when investigating odd forwarding or reachability issues.
Security teams also need to distinguish legitimate protocol behaviour from suspicious use of extension headers. Unusual routing directives, repeated attempts to traverse disallowed segments, or traffic patterns that appear to seek an alternate path can all be signals worth reviewing.
Risk and Threat Considerations
IPv6 source routing creates security risk when organisations assume the network path is fully controlled by infrastructure policy, but packets can still request alternative forwarding behaviour. That can weaken boundary enforcement, complicate traffic inspection, and make it harder to reason about where sensitive packets have travelled.
Failure mechanism: An attacker or misconfigured host can use sender-directed routing information to influence packet traversal, potentially reaching paths that normal routing policy would not select or that defenders do not monitor consistently.
Impact: The result can be policy bypass, reduced visibility, unexpected exposure of internal paths, and a harder detection problem when traffic no longer follows the network’s assumed route.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SC-7 — Boundary Protection | IPv6 source routing affects boundary enforcement and packet path control across network choke points. |
| SI-4 — System Monitoring | Unusual extension-header routing behavior is a detectable network security event for this packet path feature. | |
| CM-7 — Least Functionality | Source routing is an optional protocol capability that organizations often disable to reduce attack surface. | |
| Recommendation — Filter or restrict IPv6 source-routed packets at boundaries to preserve intended path enforcement. Monitor IPv6 traffic for anomalous extension-header use and investigate unexpected routing patterns. Disable IPv6 source routing where it is not explicitly required for business or testing needs. | ||
| CIS Controls v8 | CIS-12 — Network Infrastructure Management | The term concerns network-layer control of packet forwarding and inspection behavior. |
| CIS-13 — Network Monitoring and Defense | Detecting unexpected IPv6 path manipulation depends on visibility into network traffic and events. | |
| Recommendation — Standardize IPv6 filter policy on routers, firewalls, and inspection devices across the environment. Alert on abnormal IPv6 extension-header and forwarding patterns in network telemetry. | ||
Practitioner Guidance
What to watch for: Treat IPv6 source routing as a policy decision, not a default feature. If a network does not have a clear operational need for it, the safer posture is usually to restrict or filter it consistently across ingress points and internal choke points.
Governance implication: Keep the rule set aligned across routers, firewalls, and monitoring tools so the same IPv6 extension-header policy applies everywhere traffic can enter. Inconsistent enforcement is often where confusion and exposure begin.