RFC 5095 is a rare bird: an IETF document whose entire purpose is to remove a feature from a deployed protocol. In just a few terse pages, it killed off IPv6's Type 0 Routing Header (RH0) — and with it, the last serious attempt at source routing on the public Internet.

The feature being deprecated. IPv6, as originally specified in RFC 2460, carried over a familiar IPv4 idea: source routing. A sender could attach a Routing Header to a packet that listed a sequence of intermediate IPv6 addresses to visit before reaching the final destination. Each router on the path would pop the next address off the list, swap it into the IPv6 destination field, decrement Segments Left, and forward. Type 0 was the generic, loose form — up to roughly 89 hops could be encoded in the header.

The attack that killed it. At CanSecWest 2007, Philippe Biondi and Arnaud Ebalard gave a talk titled "IPv6 Routing Header Security" that turned heads in the operator community. Their key observation: nothing in RH0 prevented the same two addresses from appearing repeatedly. By crafting a packet whose routing header alternated between router A and router B, a single packet could be made to bounce 40+ times across the A↔B link before its hop limit expired. That is roughly an 80x amplification factor on any link the attacker could route through — a remote attacker, with no privileged position, could pin traffic to a specific inter-router link and saturate it.

Worse, it bypassed ingress filtering: even if you couldn't spoof source addresses cleanly, you could still concentrate your own traffic onto a chosen victim link. It also defeated firewalls that only inspected the outer destination field, since the real intent was hidden in the header chain.

The design decision: amputate, don't bandage. The working group considered partial fixes — disallow repeated addresses, cap segments at some small number, mandate filtering at borders. RFC 5095 rejected all of them. Instead it states that hosts and routers MUST treat RH0 as if the Routing Type were unrecognized: drop the packet and (if appropriate) send ICMPv6 Parameter Problem. Type 0 is gone. The Routing Header concept itself survives, but only Type 2 (Mobile IPv6) remained at the time. A few interesting things about this choice:

• It preserved the extension header machinery, leaving room for future routing types — which is how we got Type 4, Segment Routing over IPv6 (SRv6), a decade later.
• It explicitly noted that operators had already widely filtered RH0; the RFC was ratifying reality, not leading it.
• It declined to give RH0 a graceful deprecation window. The threat was too immediate.

Why it still matters. Three reasons. First, it's the canonical example of amplification via protocol feature — alongside DNS, NTP, and memcached reflection, but baked into the IP layer itself. Anyone designing a new packet header today should know this story. Second, it shaped how SRv6 was sold: the SR designers had to argue explicitly that their version of source routing was safe because segment lists are constrained to an operator's own domain via the HMAC TLV and strict ingress filtering. Third, it's a reminder that "we inherited it from the previous protocol" is not a security argument. IPv6 took source routing from IPv4 largely on autopilot, and it took a flashy conference demo fifteen years later to dislodge it.

If you ever wondered why ip6tables has had a rule dropping rt0 for as long as you can remember, this RFC is the reason.