| No-Operation |
1 |
Used to terminate a list of IP Options. |
ALLOW |
| Loose Source Routing and Record Route (LSRR) |
131 |
|
DROP |
| Strict Source Routing and Record Route (LSRR) |
137 |
|
DROP |
| Record Route |
7 |
|
DROP |
| Stream Identifier |
136 |
|
DROP |
| Timestamp |
68 |
|
DROP |
| Router-Alert |
148 |
Some IGMP packets may use the Router-Alert Option; furthermore, RSVP RFC 2205 uses the Router-Alert option. |
DROP in unicast-only environments. Host endpoints should ALLOW in multicast environments. |
| Probe-MTU |
11 |
Old PMTU discovery used the Probe-MTU option; however, this option is NOT employed with the modern "Path MTU Discovery" (PMTUD) mechanisms (see RFC 1191), which employs special ICMP messages (Type 3, Code 4) in combination with the IP DF-bit. Packetization Layer PMTUD (PLPMTUD) RFC 4821 can perform PMTUD without the need for any special packets. |
DROP |
| Reply-MTU |
12 |
This option originally provided a mechanism to discover the Path-MTU; it is now obsolete. |
DROP |
| Traceroute |
82 |
Originally, this option was used for traceroute; however, RFC 6814 formally obsoletes it. |
DROP |
| DoD Basic Security Option (BSO) |
130 |
The DoD Basic Security Option (BSO) was implemented in IRIX and is currently implemented in a number of operating systems (e.g., Security-Enhanced Linux (SELinux), Solaris, and Cisco IOS - Cisco-IPSO). It is also currently deployed in a number of high-security networks. These networks are typically either in physically secure locations, protected by military/governmental communications security equipment, or both. |
DROP unless BSO is known to be required |
| DoD Extended Security Option (ESO) |
133 |
|
DROP unless ESO is known to be required |
| Commercial IP Security Option (CIPSO) |
134 |
Because of the design of this option, with variable syntax and variable length, it is not practical to support specialized filtering using the CIPSO information. No routers or firewalls are known to support this option. However, routers, security gateways, and firewalls SHOULD NOT by default modify or remove this option from IP packets and SHOULD NOT by default drop packets because they contain this option. |
ALLOW unless the network admin is 100% sure CIPSO isn't required. |
| VISA |
142 |
This options was part of an experiment at the University of Southern California (USC) and was never widely deployed. |
DROP |
| Extended Internet Protocol (EIP) |
145 |
The EIP option is obsolete. This option was used (or was intended to be used) to signal that a packet superficially similar to an IPv4 packet actually contained a different protocol, opening up the possibility that an IPv4 node that simply ignored this option would process a received packet in a manner inconsistent with the intent of the sender.EIP was specified in RFC 1385. This option has been formally obsoleted by RFC 6814. |
DROP |
| Address Extension |
147 |
The Address Extension option was introduced by one of the proposals submitted during the IPng efforts to address the problem of IPv4 address exhaustion. |
DROP |
| Sender Directed Multi-Destination Delivery |
149 |
This option originally provided unreliable UDP delivery to a set of addresses included in the option. This option is specified in RFC 1770. Some environments use this option and it is hard to know ahead of time whether it is required. |
ALLOW unless 100% sure it's ok to DROP |
| Dynamic Packet State |
151 |
The Dynamic Packet State option was specified in DIFFSERV-DPS. The aforementioned document was meant to be published as "Experimental", but never made it into an RFC. This option has been formally obsoleted by RFC 6814. |
DROP |
| Upstream Multicast |
152 |
This option was originally specified in BIDIR-TREES. It was never formally standardized in the RFC series and was never widely implemented and deployed. Its use was obsoleted by RFC 5015, which employs a control-plane mechanism to solve the problem of doing upstream forwarding of multicast packets on a multi-access LAN. This option has been formally obsoleted by RFC 6814. |
DROP |
| Quick-Start |
25 |
This IP Option is used in the specification of Quick-Start for TCP and IP, which is an experimental mechanism that allows transport protocols, in cooperation with routers, to determine an allowed sending rate at the start and, at times, in the middle of a data transfer (e.g., after an idle period) RFC 4782. |
Optional (but could be helpful) to ALLOW; most networks can safely DROP |
| RFC 3692 Experimental |
30 |
Specified in RFC 4727 |
DROP |
| RFC 3692 Experimental |
94 |
Specified in RFC 4727 |
DROP |
| RFC 3692 Experimental |
158 |
Specified in RFC 4727 |
DROP |
| RFC 3692 Experimental |
222 |
Specified in RFC 4727 |
DROP |
