ESP [77] and Authentication Header (AH) [170]. However, over the years it became clear that the industry does not want to implement Security Architecture for the Internet Protocol [73] for every IPv6 stack. Therefore, the IPv6 node requirements specifically on the security part got loosened [32] and now support for Security Architecture is optional, though highly recommended. There have been numerous attempts in recent years to correct the identified IPv6 specific security vulnerabilities. We can categorize them and the related attack vectors to several groups based on their nature and the exploited vulnerability: IPv6 addressing, which covers host scanning, poisoning the router ND cache with a flood of packets that causes an address resolution to take place, and privacy breaches made possible by easily predictable addresses or stable IIDs. IPv6 fragmentation and reassembly defects used for forging IPv6 fragments in order to, for example, bypass firewalls. IPv6 first-hop and/or on-link security vulnerabilities which cover, for example, NDP message spoofing, forged redirects, traffic stealing, and rogue Router Advertisements. IPv6 firewall bypassing made possible by oversized IPv6 extension header chains or overlapping fragments. IPv6 extension header and option defects used for smurf attacks and traffic amplification using ICMPv6 and unknown options or Type 0 Routing Header. Router load generation using the router alert IPv6 hop-by-hop extensions. Some of the listed vulnerabilities do not apply as such to 3GPP architecture. More specifically, the 3GPP link model and the fact that there can be exactly one UE and the first-hop router (i.e. the PGW or in case of PMIPv6 the SGW) on the same link, make certain on-link attacks less critical. Several documented vulnerabilities are specifically targeted to shared links like Ethernet. On the other hand, 3GPP architecture from the UE point of view is as vulnerable as any IP network for off-link attacks. In the following sections we will discuss the earlier listed security 