Re: [IPsec] Avoiding Authentication Header (AH)

[RJ Atkinson <[e-mail]>]

On 02  Jan 2012, at 19:54 , Bhatia, Manav (Manav) wrote:
> And most of these are considered dangerous and are generally discouraged.
> 
> http://tools.ietf.org/html/rfc6398

That RFC says the Router Alert Option might be abused
by malicious transit traffic in global public transit 
networks, depending in part upon the quality of one's
router implementation(s).

It also says that the Router Alert Option can be deployed
safely, for example within an Administrative Domain
or in an Overlay deployment.

It does not say that all hop-by-hop options are always bad.
In fact, it says that they are often useful and can be
deployed safely.

Yours,

Ran