IPv6 Tutorial - RIPE 64

IPv6 and flows• Source nodes must make sure that there is nounintentional reuse of flow labels• Should assign flow labels in sequence• Theft of Service / Denial of Service• An attacker could possibly make use of resources that arereserved for a specific flow, by modifying flow labels• This could be taken to a denial of service attack• As the flow label is part of the IPv6 header, it is notprotected or authenticated, which means it is not moresecure than a src/dst address• Unless IPsec tunnel mode is used• Ingress filtering might give some security38