rfc9805v1.txt		rfc9805.txt
	skipping to change at line 12 ¶		skipping to change at line 12 ¶
	Internet Engineering Task Force (IETF) R. Bonica		Internet Engineering Task Force (IETF) R. Bonica
	Request for Comments: 9805 Juniper Networks		Request for Comments: 9805 Juniper Networks
	Updates: 2711 June 2025		Updates: 2711 June 2025
	Category: Standards Track		Category: Standards Track
	ISSN: 2070-1721		ISSN: 2070-1721
	Deprecation of the IPv6 Router Alert Option for New Protocols		Deprecation of the IPv6 Router Alert Option for New Protocols
	Abstract		Abstract
	This document deprecates the IPv6 Router Alert Option. Protocols		This document deprecates the IPv6 Router Alert option. Protocols
	that use the Router Alert Option may continue to do so, even in		that use the IPv6 Router Alert option may continue to do so, even in
	future versions. However, new protocols that are standardized in the		future versions. However, new protocols that are standardized in the
	future must not use the Router Alert Option.		future must not use the IPv6 Router Alert option.
	This document updates RFC 2711.		This document updates RFC 2711.
	Status of This Memo		Status of This Memo
	This is an Internet Standards Track document.		This is an Internet Standards Track document.
	This document is a product of the Internet Engineering Task Force		This document is a product of the Internet Engineering Task Force
	(IETF). It represents the consensus of the IETF community. It has		(IETF). It represents the consensus of the IETF community. It has
	received public review and has been approved for publication by the		received public review and has been approved for publication by the
	skipping to change at line 60 ¶		skipping to change at line 60 ¶
	1. Introduction		1. Introduction
	2. Requirements Language		2. Requirements Language
	3. Issues Associated with the IPv6 Router Alert Option		3. Issues Associated with the IPv6 Router Alert Option
	4. Deprecation of the IPv6 Router Alert Option		4. Deprecation of the IPv6 Router Alert Option
	5. Future Work		5. Future Work
	6. Security Considerations		6. Security Considerations
	7. IANA Considerations		7. IANA Considerations
	8. References		8. References
	8.1. Normative References		8.1. Normative References
	8.2. Informative References		8.2. Informative References
	Appendix A. Protocols That Use the Router Alert Option		Appendix A. Protocols That Use the IPv6 Router Alert Option
	Acknowledgements		Acknowledgements
	Author's Address		Author's Address
	1. Introduction		1. Introduction
	In IPv6 [RFC8200], optional internet-layer information is encoded in		In IPv6 [RFC8200], optional internet-layer information is encoded in
	separate headers that may be placed between the IPv6 header and the		separate headers that may be placed between the IPv6 header and the
	upper-layer header in a packet. There is a small number of such		upper-layer header in a packet. There is a small number of such
	extension headers, each one identified by a distinct Next Header		extension headers, each one identified by a distinct Next Header
	value.		value.
	One of these extension headers is called the Hop-by-Hop Options		One of these extension headers is called the Hop-by-Hop Options
	header. The Hop-by-Hop Options header is used to carry optional		header. The Hop-by-Hop Options header is used to carry optional
	information that may be examined and processed by every node along a		information that may be examined and processed by every node along a
	packet's delivery path.		packet's delivery path.
	The Hop-by-Hop Options header can carry one or more options. Among		The Hop-by-Hop Options header can carry one or more options. Among
	these is the Router Alert Option [RFC2711].		these is the IPv6 Router Alert option [RFC2711].
	The Router Alert Option provides a mechanism whereby routers can know		The IPv6 Router Alert option provides a mechanism whereby routers can
	when to intercept datagrams not addressed to them without having to		know when to intercept datagrams not addressed to them without having
	extensively examine every datagram. The semantic of the Router Alert		to extensively examine every datagram. The semantic of the IPv6
	Option is that "routers should examine this datagram more closely".		Router Alert option is that "routers should examine this datagram
	Excluding this option tells the router that there is no need to		more closely". Excluding this option tells the router that there is
	examine this datagram more closely.		no need to examine this datagram more closely.
	As explained below, the Router Alert Option introduces many issues.		As explained below, the IPv6 Router Alert option introduces many
			issues.
	This document updates [RFC2711]. Implementers of protocols that		This document updates [RFC2711]. Implementers of protocols that
	continue to use the Router Alert Option can continue to reference		continue to use the IPv6 Router Alert option can continue to
	[RFC2711] for Router Alert Option details.		reference [RFC2711] for IPv6 Router Alert option details.
	2. Requirements Language		2. Requirements Language
	The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",		The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
	"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and		"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
	"OPTIONAL" in this document are to be interpreted as described in		"OPTIONAL" in this document are to be interpreted as described in
	BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all		BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all
	capitals, as shown here.		capitals, as shown here.
	3. Issues Associated with the IPv6 Router Alert Option		3. Issues Associated with the IPv6 Router Alert Option
	[RFC6398] identifies security considerations associated with the		[RFC6398] identifies security considerations associated with the IPv6
	Router Alert Option. In a nutshell, the IP Router Alert Option does		Router Alert option. In a nutshell, the IP Router Alert Option does
	not provide a universal mechanism to accurately and reliably		not provide a universal mechanism to accurately and reliably
	distinguish between IP Router Alert packets of interest and unwanted		distinguish between IP Router Alert packets of interest and unwanted
	IP Router Alerts. This creates a security concern because, short of		IP Router Alerts. This creates a security concern because, short of
	appropriate router-implementation-specific mechanisms, the router's		appropriate router-implementation-specific mechanisms, the router's
	control plane is at risk of being flooded by unwanted traffic.		control plane is at risk of being flooded by unwanted traffic.
	NOTE: Many routers maintain separation between forwarding and control		| NOTE: Many routers maintain separation between forwarding and
	plane hardware. The forwarding plane is implemented on high-		| control plane hardware. The forwarding plane is implemented on
	performance Application-Specific Integrated Circuits (ASICs) and		| high-performance Application-Specific Integrated Circuits
	Network Processors (NPs), while the control plane is implemented on		| (ASICs) and Network Processors (NPs), while the control plane
	general-purpose processors. Given this difference, the control plane		| is implemented on general-purpose processors. Given this
	is more susceptible to a Denial-of-Service (DoS) attack than the		| difference, the control plane is more susceptible to a Denial-
	forwarding plane.		| of-Service (DoS) attack than the forwarding plane.
	[RFC6192] demonstrates how a network operator can deploy Access		[RFC6192] demonstrates how a network operator can deploy Access
	Control Lists (ACLs) that protect the control plane from DoS attacks.		Control Lists (ACLs) that protect the control plane from DoS attacks.
	These ACLs are effective and efficient when they select packets based		These ACLs are effective and efficient when they select packets based
	upon information that can be found in a fixed position. However,		upon information that can be found in a fixed position. However,
	they become less effective and less efficient when they must parse an		they become less effective and less efficient when they must parse a
	IPv6 Hop-by-Hop Options header, searching for the Router Alert		Hop-by-Hop Options header, searching for the IPv6 Router Alert
	Option.		option.
	Network operators can address the security considerations raised in		Network operators can address the security considerations raised in
	[RFC6398] by:		[RFC6398] by:
	* Deploying the operationally complex and computationally expensive		* Deploying the operationally complex and computationally expensive
	ACLs described in [RFC6192].		ACLs described in [RFC6192].
	* Configuring their routers to ignore the Router Alert Option.		* Configuring their routers to ignore the IPv6 Router Alert option.
	* Dropping or severely rate limiting packets that contain the IPv6		* Dropping or severely rate limiting packets that contain the Hop-
	Hop-by-Hop Options header at the network edge.		by-Hop Options header at the network edge.
	These options become less viable as protocol designers continue to		These options become less viable as protocol designers continue to
	design protocols that use the Router Alert Option.		design protocols that use the IPv6 Router Alert option.
	[RFC9673] seeks to eliminate hop-by-hop processing on the control		[RFC9673] seeks to eliminate hop-by-hop processing on the control
	plane. However, because of its unique function, the Router Alert		plane. However, because of its unique function, the IPv6 Router
	option is granted an exception to this rule. One approach would be		Alert option is granted an exception to this rule. One approach
	to deprecate the Router Alert option, because current usage beyond		would be to deprecate the IPv6 Router Alert option, because current
	the local network appears to be limited and packets containing Hop-		usage beyond the local network appears to be limited and packets
	by-Hop options are frequently dropped. Deprecation would allow		containing Hop-by-Hop options are frequently dropped. Deprecation
	current implementations to continue using it, but its use could be		would allow current implementations to continue using it, but its use
	phased out over time.		could be phased out over time.
	4. Deprecation of the IPv6 Router Alert Option		4. Deprecation of the IPv6 Router Alert Option
	This document deprecates the IPv6 Router Alert Option. Protocols		This document deprecates the IPv6 Router Alert option. Protocols
	that use the Router Alert Option MAY continue to do so, even in		that use the IPv6 Router Alert option MAY continue to do so, even in
	future versions. However, new protocols that are standardized in the		future versions. However, new protocols that are standardized in the
	future MUST NOT use the Router Alert Option. Appendix A contains an		future MUST NOT use the IPv6 Router Alert option. Appendix A
	exhaustive list of protocols that may continue to use the Router		contains an exhaustive list of protocols that MAY continue to use the
	Alert Option.		IPv6 Router Alert option.
	This document updates [RFC2711].		This document updates [RFC2711].
	5. Future Work		5. Future Work
	A number of protocols use the Router Alert option; these are listed		A number of protocols use the IPv6 Router Alert option; these are
	in Appendix A. The only protocols in Appendix A that have widespread		listed in Appendix A. The only protocols in Appendix A that have
	deployment are Multicast Listener Discovery Version 2 (MLDv2)		widespread deployment are Multicast Listener Discovery Version 2
	[RFC3810] and Multicast Router Discovery (MRD) [RFC4286]. The other		(MLDv2) [RFC9777] and Multicast Router Discovery (MRD) [RFC4286].
	protocols either have limited deployment, are experimental, or have		The other protocols either have limited deployment, are experimental,
	no known implementation.		or have no known implementation.
	It is left for future work to develop new versions of MLDv2 and MRD		It is left for future work to develop new versions of MLDv2 and MRD
	that do not rely on the Router Alert option. That task is out of		that do not rely on the IPv6 Router Alert option. That task is out
	scope for this document.		of scope for this document.
	6. Security Considerations		6. Security Considerations
	This document mitigates all security considerations associated with		This document mitigates all security considerations associated with
	the IPv6 Router Alert Option. These security considerations can be		the IPv6 Router Alert option. These security considerations can be
	found in [RFC2711], [RFC6192], and [RFC6398].		found in [RFC2711], [RFC6192], and [RFC6398].
	7. IANA Considerations		7. IANA Considerations
	IANA has marked the Router Alert Option as "DEPRECATED for New		IANA has marked the IPv6 Router Alert option as "DEPRECATED for New
	Protocols" in the "Destination Options and Hop-by-Hop Options"		Protocols" in the "Destination Options and Hop-by-Hop Options"
	registry <https://www.iana.org/assignments/ipv6-parameters> and added		registry <https://www.iana.org/assignments/ipv6-parameters> and added
	this document as a reference.		this document as a reference.
	IANA has also made a note in the "IPv6 Router Alert Option Values"		IANA has also made a note in the "IPv6 Router Alert Option Values"
	registry <https://www.iana.org/assignments/ipv6-routeralert-values>		registry <https://www.iana.org/assignments/ipv6-routeralert-values>
	stating that the registry is closed for allocations and added a		stating that the registry is closed for allocations and added a
	reference to this document. The experimental codepoints in this		reference to this document. The experimental codepoints in this
	registry have been changed to "Reserved" (i.e., they are no longer		registry have been changed to "Reserved" (i.e., they are no longer
	available for experimentation).		available for experimentation).
	skipping to change at line 248 ¶		skipping to change at line 249 ¶
	RFC 3175, DOI 10.17487/RFC3175, September 2001,		RFC 3175, DOI 10.17487/RFC3175, September 2001,
	<https://www.rfc-editor.org/info/rfc3175>.		<https://www.rfc-editor.org/info/rfc3175>.
	[RFC3208] Speakman, T., Crowcroft, J., Gemmell, J., Farinacci, D.,		[RFC3208] Speakman, T., Crowcroft, J., Gemmell, J., Farinacci, D.,
	Lin, S., Leshchiner, D., Luby, M., Montgomery, T., Rizzo,		Lin, S., Leshchiner, D., Luby, M., Montgomery, T., Rizzo,
	L., Tweedly, A., Bhaskar, N., Edmonstone, R.,		L., Tweedly, A., Bhaskar, N., Edmonstone, R.,
	Sumanasekera, R., and L. Vicisano, "PGM Reliable Transport		Sumanasekera, R., and L. Vicisano, "PGM Reliable Transport
	Protocol Specification", RFC 3208, DOI 10.17487/RFC3208,		Protocol Specification", RFC 3208, DOI 10.17487/RFC3208,
	December 2001, <https://www.rfc-editor.org/info/rfc3208>.		December 2001, <https://www.rfc-editor.org/info/rfc3208>.
	[RFC3810] Vida, R., Ed. and L. Costa, Ed., "Multicast Listener
	Discovery Version 2 (MLDv2) for IPv6", RFC 3810,
	DOI 10.17487/RFC3810, June 2004,
	<https://www.rfc-editor.org/info/rfc3810>.
	[RFC4080] Hancock, R., Karagiannis, G., Loughney, J., and S. Van den		[RFC4080] Hancock, R., Karagiannis, G., Loughney, J., and S. Van den
	Bosch, "Next Steps in Signaling (NSIS): Framework",		Bosch, "Next Steps in Signaling (NSIS): Framework",
	RFC 4080, DOI 10.17487/RFC4080, June 2005,		RFC 4080, DOI 10.17487/RFC4080, June 2005,
	<https://www.rfc-editor.org/info/rfc4080>.		<https://www.rfc-editor.org/info/rfc4080>.
	[RFC4286] Haberman, B. and J. Martin, "Multicast Router Discovery",		[RFC4286] Haberman, B. and J. Martin, "Multicast Router Discovery",
	RFC 4286, DOI 10.17487/RFC4286, December 2005,		RFC 4286, DOI 10.17487/RFC4286, December 2005,
	<https://www.rfc-editor.org/info/rfc4286>.		<https://www.rfc-editor.org/info/rfc4286>.
	[RFC5946] Le Faucheur, F., Manner, J., Narayanan, A., Guillou, A.,		[RFC5946] Le Faucheur, F., Manner, J., Narayanan, A., Guillou, A.,
	skipping to change at line 307 ¶		skipping to change at line 303 ¶
	Aldrin, S., and M. Chen, "Detecting Multiprotocol Label		Aldrin, S., and M. Chen, "Detecting Multiprotocol Label
	Switched (MPLS) Data-Plane Failures", RFC 8029,		Switched (MPLS) Data-Plane Failures", RFC 8029,
	DOI 10.17487/RFC8029, March 2017,		DOI 10.17487/RFC8029, March 2017,
	<https://www.rfc-editor.org/info/rfc8029>.		<https://www.rfc-editor.org/info/rfc8029>.
	[RFC9570] Kompella, K., Bonica, R., and G. Mirsky, Ed., "Deprecating		[RFC9570] Kompella, K., Bonica, R., and G. Mirsky, Ed., "Deprecating
	the Use of Router Alert in LSP Ping", RFC 9570,		the Use of Router Alert in LSP Ping", RFC 9570,
	DOI 10.17487/RFC9570, May 2024,		DOI 10.17487/RFC9570, May 2024,
	<https://www.rfc-editor.org/info/rfc9570>.		<https://www.rfc-editor.org/info/rfc9570>.
	Appendix A. Protocols That Use the Router Alert Option		[RFC9777] Haberman, B., Ed., "Multicast Listener Discovery Version 2
			(MLDv2) for IPv6", STD 101, RFC 9777,
			DOI 10.17487/RFC9777, March 2025,
			<https://www.rfc-editor.org/info/rfc9777>.
			Appendix A. Protocols That Use the IPv6 Router Alert Option
	Table 1 contains an exhaustive list of protocols that use the IPv6		Table 1 contains an exhaustive list of protocols that use the IPv6
	Router Alert Option. There are no known IPv6 implementations of MPLS		Router Alert option. There are no known IPv6 implementations of MPLS
	Ping. Neither Integrated Services (INTSERV) nor Next Steps in		Ping. Neither Integrated Services (Intserv) nor Next Steps in
	Signaling (NSIS) are widely deployed. All NSIS protocols are		Signaling (NSIS) are widely deployed. All NSIS protocols are
	experimental. Pragmatic Generic Multicast (PGM) is experimental, and		experimental. Pragmatic Generic Multicast (PGM) is experimental, and
	there are no known IPv6 implementations.		there are no known IPv6 implementations.
	+=================+=============================+==================+		+=================+=============================+==================+
	| Protocol | References | Application |		| Protocol | References | Application |
	+=================+=============================+==================+		+=================+=============================+==================+
	| Multicast | [RFC3810] | IPv6 Multicast |		| Multicast | [RFC9777] | IPv6 Multicast |
	| Listener | | |		| Listener | | |
	| Discovery | | |		| Discovery | | |
	| Version 2 | | |		| Version 2 | | |
	| (MLDv2) | | |		| (MLDv2) | | |
	+-----------------+-----------------------------+------------------+		+-----------------+-----------------------------+------------------+
	| Multicast | [RFC4286] | IPv6 Multicast |		| Multicast | [RFC4286] | IPv6 Multicast |
	| Router | | |		| Router | | |
	| Discovery (MRD) | | |		| Discovery (MRD) | | |
	+-----------------+-----------------------------+------------------+		+-----------------+-----------------------------+------------------+
	| Pragmatic | [RFC3208] | IPv6 Multicast |		| Pragmatic | [RFC3208] | IPv6 Multicast |
	| General | | |		| General | | |
	| Multicast (PGM) | | |		| Multicast (PGM) | | |
	+-----------------+-----------------------------+------------------+		+-----------------+-----------------------------+------------------+
	| MPLS Ping (Use | [RFC7506][RFC8029][RFC9570] | MPLS Operations, |		| MPLS Ping (Use | [RFC7506][RFC8029][RFC9570] | MPLS Operations, |
	| of router alert | | Administration, |		| of the IPv6 | | Administration, |
	| deprecated) | | and Maintenance |		| Router Alert | | and Maintenance |
	| | | (OAM) |		| option is | | (OAM) |
			| deprecated) | | |
	+-----------------+-----------------------------+------------------+		+-----------------+-----------------------------+------------------+
	| Resource | [RFC3175] [RFC5946] | Integrated |		| Resource | [RFC3175] [RFC5946] | Integrated |
	| Reservation | [RFC6016] [RFC6401] | Services |		| Reservation | [RFC6016] [RFC6401] | Services |
	| Protocol | | (INTSERV) |		| Protocol | | (Intserv) |
	| (RSVP): Both | | [RFC1633] and |		| (RSVP): Both | | [RFC1633] and |
	| IPv4 and IPv6 | | Multiprotocol |		| IPv4 and IPv6 | | Multiprotocol |
	| implementations | | Label Switching |		| implementations | | Label Switching |
	| | | (MPLS) [RFC3031] |		| | | (MPLS) [RFC3031] |
	+-----------------+-----------------------------+------------------+		+-----------------+-----------------------------+------------------+
	| Next Steps in | [RFC5979] [RFC5971] | NSIS [RFC4080] |		| Next Steps in | [RFC5979] [RFC5971] | NSIS [RFC4080] |
	| Signaling | | |		| Signaling | | |
	| (NSIS) | | |		| (NSIS) | | |
	+-----------------+-----------------------------+------------------+		+-----------------+-----------------------------+------------------+
End of changes. 26 change blocks.
	65 lines changed or deleted		67 lines changed or added
This html diff was produced by rfcdiff 1.48.