 Source Address Validation Improvements (SAVI) [95, 96]. Essentially, the ingress filter on a router will ensure that a host cannot send packets with a source address that has not been given by that network. The main intent is to prevent misbehaving or malicious hosts from sending packets with somebody else's IP address. By doing this the filtering routers protects the Internet against attacks utilizing source address spoofing. Somewhat unfortunately, in the case of multi-interfaced hosts, the router performing filtering on one network might be unaware of the other legitimate addresses the host has configured from other networks to which the host is also connected at the same time. In some scenarios, essentially those that do not involve dynamic network selection, ingress filtering rules can be adapted to support multi-interfacing behavior - see RFC 3704 (BCP 84) [97]. In any case, if a host is dynamically selecting networks it attaches to, and hence networks have no way to adapt their ingress filters based on the hosts changing state, the host has to be careful to send packets only with source addresses legitimate on the interface used to send the packets. 3.5.5 Privacy and Cryptographically Generated Addresses The source IP address used by a node in the packets it sends, by design, points back to the node. In some cases, such as when Network Address Translators (NAT) are in the network - as is increasingly often the case with IPv4 - the IP address seen on the Internet points to the NAT entity thus hiding the actual source of the packet. A static and public IP address comes with benefits, but also with some cons. The main benefits are stability and better connectivity options. The downside is decreased privacy: a static address can Introduction to IPv6 be used to identify a node in the Internet, thus enabling things such as user tracking and user identification. Tracking based on IP address is a more serious issue in the case of IPv6. In IPv4, NATs are becoming increasingly common, and the IPv4 address is always