Engineers building firewall rules often block all IPv4 packets with IPv4 Options set in the header. However, there are a few common and valid use-cases for IPv4 Options.

This Q&A is intended to be used as a community wiki to be edited with valid uses for the various IPv4 Options. References to applicable RFCs for each entry are encouraged, but should not be required.

Scope: Entries in this list SHOULD account for both endpoint firewalls (such as linux IPTables) as well as Network firewall use-cases.

By default, most of the original content for this wiki came from RFC 7126: Best Current Practice: Filtering of IP-Optioned Packets; it serves as a useful source for many of the initial entries in this Q&A.

1 Answer 1


IPv4 Options-handling recommendations from RFC 7126: Best Current Practice: Filtering of IP-Optioned Packets:

IPv4 Option Name Type Usage notes / Comments Firewall Recommendations
No-Operation 1 Used to terminate a list of IP Options. ALLOW
Loose Source Routing and Record Route (LSRR) 131 DROP
Strict Source Routing and Record Route (LSRR) 137 DROP
Record Route 7 DROP
Stream Identifier 136 DROP
Timestamp 68 DROP
Router-Alert 148 Some IGMP packets may use the Router-Alert Option; furthermore, RSVP RFC 2205 uses the Router-Alert option. DROP in unicast-only environments. Host endpoints should ALLOW in multicast environments.
Probe-MTU 11 Old PMTU discovery used the Probe-MTU option; however, this option is NOT employed with the modern "Path MTU Discovery" (PMTUD) mechanisms (see RFC 1191), which employs special ICMP messages (Type 3, Code 4) in combination with the IP DF-bit. Packetization Layer PMTUD (PLPMTUD) RFC 4821 can perform PMTUD without the need for any special packets. DROP
Reply-MTU 12 This option originally provided a mechanism to discover the Path-MTU; it is now obsolete. DROP
Traceroute 82 Originally, this option was used for traceroute; however, RFC 6814 formally obsoletes it. DROP
DoD Basic Security Option (BSO) 130 The DoD Basic Security Option (BSO) was implemented in IRIX and is currently implemented in a number of operating systems (e.g., Security-Enhanced Linux (SELinux), Solaris, and Cisco IOS - Cisco-IPSO). It is also currently deployed in a number of high-security networks. These networks are typically either in physically secure locations, protected by military/governmental communications security equipment, or both. DROP unless BSO is known to be required
DoD Extended Security Option (ESO) 133 DROP unless ESO is known to be required
Commercial IP Security Option (CIPSO) 134 Because of the design of this option, with variable syntax and variable length, it is not practical to support specialized filtering using the CIPSO information. No routers or firewalls are known to support this option. However, routers, security gateways, and firewalls SHOULD NOT by default modify or remove this option from IP packets and SHOULD NOT by default drop packets because they contain this option. ALLOW unless the network admin is 100% sure CIPSO isn't required.
VISA 142 This options was part of an experiment at the University of Southern California (USC) and was never widely deployed. DROP
Extended Internet Protocol (EIP) 145 The EIP option is obsolete. This option was used (or was intended to be used) to signal that a packet superficially similar to an IPv4 packet actually contained a different protocol, opening up the possibility that an IPv4 node that simply ignored this option would process a received packet in a manner inconsistent with the intent of the sender.EIP was specified in RFC 1385. This option has been formally obsoleted by RFC 6814. DROP
Address Extension 147 The Address Extension option was introduced by one of the proposals submitted during the IPng efforts to address the problem of IPv4 address exhaustion. DROP
Sender Directed Multi-Destination Delivery 149 This option originally provided unreliable UDP delivery to a set of addresses included in the option. This option is specified in RFC 1770. Some environments use this option and it is hard to know ahead of time whether it is required. ALLOW unless 100% sure it's ok to DROP
Dynamic Packet State 151 The Dynamic Packet State option was specified in DIFFSERV-DPS. The aforementioned document was meant to be published as "Experimental", but never made it into an RFC. This option has been formally obsoleted by RFC 6814. DROP
Upstream Multicast 152 This option was originally specified in BIDIR-TREES. It was never formally standardized in the RFC series and was never widely implemented and deployed. Its use was obsoleted by RFC 5015, which employs a control-plane mechanism to solve the problem of doing upstream forwarding of multicast packets on a multi-access LAN. This option has been formally obsoleted by RFC 6814. DROP
Quick-Start 25 This IP Option is used in the specification of Quick-Start for TCP and IP, which is an experimental mechanism that allows transport protocols, in cooperation with routers, to determine an allowed sending rate at the start and, at times, in the middle of a data transfer (e.g., after an idle period) RFC 4782. Optional (but could be helpful) to ALLOW; most networks can safely DROP
RFC 3692 Experimental 30 Specified in RFC 4727 DROP
RFC 3692 Experimental 94 Specified in RFC 4727 DROP
RFC 3692 Experimental 158 Specified in RFC 4727 DROP
RFC 3692 Experimental 222 Specified in RFC 4727 DROP

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.