e all the multicast receiving nodes to flood the victim host with ICMPv6 messages. Another traffic amplification attack is available using the now deprecated Type 0 Rout- ing Header (RH0) [187, 136]. The RHO allows source routing of IPv6 packets via a list of predefined destination nodes. A single 1280-octet IPv6 packet with a single RHO can contain over 70 intermediate node addresses. A cleverly constructed packet with an RHO option can be made to oscillate between two IPv6 nodes or routers as long as all entries (destinations) in the RHO option have been consumed. This allows for an off-link attacker a rather cheap way to cause congestion on a path between two nodes. All hop-by-hop options must be processed or at least examined by all intermediate nodes between the source and the destination. IPv6 Router Alert Option is an example [129] of a hop-by-hop option, which is currently used by MLD and MLDv2, for example. A router on a path would examine the packet more closely, which typically means it gets pulled out of the fast path for the Central Processing Unit (CPU) to process. Obviously, this is more costly from the router perspective and when a router is flooded with such packets, the IPv6 Router Alert option can be used as a DoS mechanism. Are the above attacks and vulnerabilities issues in the 3GPP architecture? They poten- tially are, and could make a mobile system as a good resource pool for an attacker to source distributed attacks. However, we could speculate that the 3GPP link model and lack of native IP level multicast and non-existing deployments of MBMS could mitigate somewhat the described attacks. At least orchestrating such remotely would be slightly more challenging. Deploying IPv6 in 3GPP Networks Bypassing Firewalls IPv6 allows arbitrary extension header size that can even be fragmented into several packets. Use of unusually long extension header chains [188, 189] opens possibilities for a couple of attacks and possible vulnerabilities in firewall products. Firewall filtering rules are typicall