MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\DisableIPSourceRouting
A DWORD value of 2 selects the highest IPv6 source-routing protection level. Windows drops incoming IPv6 packets that use source routing, preventing them from being processed locally or forwarded to another system.
Source routing allows a packet’s sender to influence the network path that the packet is intended to follow. This value disables that behavior completely for received IPv6 traffic.
Notes
Security
Dropping source-routed packets limits the opportunity to misuse sender-selected network paths for packet spoofing or related traffic-manipulation attacks. It does not validate IPv6 source addresses generally and is not a substitute for firewalling or other network access controls.
Possible side effects
IPv6 communications that explicitly depend on source routing no longer work. Ordinary IPv6 traffic that does not use source routing remains enabled.
Notes
This value applies to IPv6. The corresponding IPv4 value is stored at HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DisableIPSourceRouting and is not changed by this setting.
Microsoft also maps this registry value to the policy named MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing). The behavior described here applies specifically to the DisableIPSourceRouting registry value when its data is 2.
Microsoft documentation
Microsoft Learn: Policy CSP – MSSLegacy – IPv6SourceRoutingProtectionLevel
Microsoft Learn: Windows security baseline