es, and address assignment on the link. Technologies like Source Address Validation Improvements (SAVI) [183, 184] and RA Guard [185] fit into this category. These mechanisms are intended to complement ingress filtering techniques to help detect and prevent source address spoofing, and also filter bogus Router Advertisement messages. Are the above threats and vulnerabilities issues in the 3GPP architecture? This is not likely, due to the 3GPP link model described in Section 4.1.3. A PGW router and a UE can be the only nodes on the same 3GPP point-to-point link. Furthermore, as discussed IPv6 in 3GPP Networks in Section 4.10.1 most of the NDP procedures can just be neglected in the UE or in the PGW. For any of the on-link threats to be possible, the PGW should more or less be compromised and its software modified. 4.10.3 IPv6 Extension Header Exploits IPv6 is extended using a number of different extension headers and their options - see Section 3.2. The attacks we are discussing in this section are based on a misuse of legitimate extension headers. Option Processing Exploits Standard IPv6 hop-by-hop and destination option header handling can be used for a smurf and traffic amplification attack [186]. The attack requires that the hostile host is able to spoof the source address of the sent packet, and multicast forwarding is supported in the attack sourcing network. The used exploit is rather simple. The IPv6 extension header has a one-octet-long option type code and its highest-order two bits specify the action that must be taken if the IPv6 node does not recognize the option type. One of the option types, namely 10xxxxxx, causes the processing node to discard the packet and send an ICMPv6 Parameter Problem, Code 2, message to the original packet's source address regardless of the original destination address being a multicast address. As a result, a hostile host can send any spoofed packet with a bogus option type in any hop-by-hop or destination option to a known multicast group or address, which would then caus