EXAMINING AND CONTROLLING IPv6 EXTENSION HEADERS

A non-transitory computer-readable storage medium embodying a set of instructions, which when executed by one or more processors of a unified threat management (UTM) device associated with a protected network, cause the one or more processors to perform a method comprising:

• maintaining sender reputation information for each of a plurality of Internet Protocol (IP) addresses observed by the UTM device to be a sender of IP version 6 (IPv6) packets or IPv6 packet fragments, wherein the sender reputation information is indicative of proper use or misuse of IPv6 extension headers by the plurality of source IP addresses;
• and
• receiving an IPv6 packet or IPv6 packet fragment from a particular source IP address of the plurality of IP addresses;
• applying a set of security checks to extension headers contained within the IPv6 packet or IPv6 packet fragment, wherein the set of security checks includes at least one security check relating to a limit on a number of extension headers that may be included within the IPv6 packet or the IPv6 packet fragment based on an application or protocol with which the IPv6 packet or IPv6 packet fragment is associated;
• based on results of the set of security checks, indicating conformity or non-conformity of the extension headers with one or more security checks of the set of security checks, updating the sender reputation information for the particular source IP address;
• and
• based on the sender reputation information for the particular source IP address, dropping, rate limiting or quarantining the IPv6 packet or IPv6 packet fragment.