his attack. Are these threats and vulnerabilities issues in the 3GPP architecture? Naturally some are but not all. As we saw in Section 4.1.3 the 3GPP link is a point-to-point link without link-layer addresses, and the UE is the only end host on the link. Also the /64 prefix advertised to the 3GPP UE is never on-link (the PIO 'L'-flag is set to 0). Therefore, a PGW can skip address resolution on the 3GPP link and just forward the whole /64 to the UE. As a result, the PGW is not vulnerable, for example, to an ND cache poisoning attack. The EUI-64 that the end host comes up with should never be derived from an IEEE 48-bit MAC address as there in no kind of link-layer address available in the UE. As noted in Section 4.9.1, this is not always the case. Furthermore, there have also been concerns that the UE IP stack might use permanent subscriber identities, such as an IMSI, as the source for the IPv6 address IID. This would be a privacy threat and would allow tracking of subscribers. Therefore, the use of an IMSI (or any 3GPP specific identity [113]) as the IID is prohibited [15]. The use of privacy addresses [109] is encouraged in the UE Deploying IPv6 in 3GPP Networks implementations. However, there is no standardized method of blocking misbehaving UEs that use a 'wrong' type of IID. Most network connections are expected to be relatively short-lived, and static IPv6 addressing is probably not going to be too popular in the consumer mass market. As a result the UEs (and subscribers) are likely to have frequently changing prefix, which combined with any decent IPv6 IID generation method should provide adequate privacy from the IPv6 addressing point of view. 4.10.2 IPv6 First-hop Security This section discusses known IPv6 NDP exploiting vulnerabilities in the context of 3GPP architecture. We only consider user plane addressing which concerns the UE, thus we are not going to look into attacks and vulnerabilities that directly target the GPRS/EPC core network nodes on their transport and control planes. We have already 