Ipv4 Options - Learning Module

Loading content...

0/228

Strict Source Routing Option

Taking Complete Control of Packet Paths

In normal IP routing, packets find their own way through the network—each router makes an independent forwarding decision based on its routing table. But what if you need absolute control over the exact path a packet takes? What if you need to ensure traffic flows through specific routers for monitoring, testing, or policy compliance?

Strict Source Routing (SSR) answers this need by allowing the source host to specify the complete, exact sequence of routers the packet must traverse. No deviations are permitted—if any specified router cannot be reached directly from the previous hop, the packet is dropped. It's the ultimate expression of sender-controlled routing.

What You Will Learn

By the end of this page, you will understand how Strict Source Routing works, its option structure and pointer mechanics, how routers process source-routed packets, error handling when routes fail, and why this option is almost universally blocked on modern networks.

Understanding Source Routing

Source routing inverts the traditional routing paradigm. Instead of routers determining paths, the source host specifies the route.

Traditional Routing:

Source sends packet with destination address
Each router independently decides next hop
Path emerges from collective routing decisions
Source has no control over path taken

Source Routing:

Source specifies complete path in packet header
Each router follows instructions in the header
Path is predetermined by the sender
Routers act as directed forwarding agents

Converting Mermaid diagram...

Two Flavors of Source Routing:

IPv4 provides two source routing options with different strictness levels:

Option	Type Value	Behavior
Strict Source Routing	137 (0x89)	Must go directly through each specified router—no intermediate hops allowed
Loose Source Routing	131 (0x83)	Must visit each specified router, but normal routing allowed between them

This page focuses on Strict Source Routing (SSR). The next page covers Loose Source Routing (LSR).

Strict Source Routing Option Structure

The Strict Source Route (SSR) option, also called Strict Source and Record Route (SSRR), uses the same format as Record Route with similar semantics but different purpose.

+--------+--------+--------+--------+
|  Type  | Length | Pointer|        |
| (137)  |        |        | IP #1  |
+--------+--------+--------+--------+
|         IP Address #1             |
+-----------------------------------+
|         IP Address #2             |
+-----------------------------------+
|            ...                    |
+-----------------------------------+
|         IP Address #N             |
+-----------------------------------+

Option Identification:

Field	Value	Binary	Description
Type	137	10001001	SSR identifier
Copy Flag	1	bit 0	Copied to all fragments
Class	0	bits 1-2	Control option
Number	9	bits 3-7	Option number within class

Copy Flag Is Set

Unlike Record Route (copy=0), SSR has copy flag set to 1. This is critical: every fragment needs routing instructions. If fragments could take different paths without routing info, they'd never reach the destination correctly.

SSR Option Fields
Field	Size	Offset	Purpose
Type	1 byte	0	Value 137 (0x89) - identifies SSR
Length	1 byte	1	Total option length (3 + 4×N)
Pointer	1 byte	2	Points to next route address to use
Route Data	4×N bytes	3+	Sequence of router IP addresses

What Makes It "Strict"

The "strict" in Strict Source Routing means no intermediate hops are allowed between specified routers. Each router in the list must be directly reachable from the previous router.

Direct Reachability Requirement:

Router A and Router B are "directly connected" if they share a physical link or subnet
There can be NO intervening Layer 3 devices
Switches and bridges (Layer 2) are acceptable between them
Another router in between violates the strict requirement

Example Scenarios:

Valid Strict Route

•Specified: R1 → R2 → R3
•R1 directly connected to R2 ✓
•R2 directly connected to R3 ✓
•Packet successfully delivered
•Each hop is adjacent

Invalid Strict Route

•Specified: R1 → R3 (skipping R2)
•R1 NOT directly connected to R3 ✗
•R2 exists between them
•Packet DROPPED at R1
•ICMP error sent to source

Converting Mermaid diagram...

Error Condition

When a router cannot reach the next specified address directly, it generates an ICMP Destination Unreachable message with code 5 (Source Route Failed) and drops the packet. The source learns that the strict route is impossible.

Router Processing Algorithm

When a router receives a packet with Strict Source Routing, it follows a specific algorithm that differs significantly from normal forwarding.

Processing Steps:

Check if we're the destination: Compare packet's destination IP with our interfaces
If NOT destination: Normal routing applies, but SSR processing still occurs
If we ARE the destination in header:
- Check pointer against length
- If pointer > length: We're the FINAL destination, deliver to upper layer
- If pointer ≤ length: We're an intermediate stop
Intermediate processing:
- Read next address from pointer position
- Strict check: Is next address DIRECTLY reachable?
- If NO: Send ICMP error, drop packet
- If YES: Swap destination address with next route entry
- Record our address in the route (replacing the one we just used)
- Advance pointer by 4
- Forward to new destination

Converting Mermaid diagram...

The Address Swap Mechanism:

This is the clever part of source routing. The packet's destination address changes at each hop:

Original destination holds the NEXT router to visit
When that router receives the packet, it:
- Takes its own address out of the route list
- Puts the FOLLOWING router into the destination field
- Records itself where the extracted address was
This continues until pointer exceeds length
At that point, the destination field contains the FINAL destination

This mechanism allows the packet to "walk" through the specified route while simultaneously recording the path taken.

Detailed Processing Example

Let's trace a packet through strict source routing step by step.

Scenario:

Host A (192.168.1.10) wants to reach Host B (10.20.30.40)
Strict route specified: via R1 (10.0.1.1) → R2 (10.0.2.1) → R3 (10.0.3.1)
All routers are directly connected in sequence

Packet State at Each Stage
Stage	IP Destination	Pointer	Route Data[0]	Route Data[1]	Route Data[2]
Host A sends	10.0.1.1 (R1)	4	10.0.2.1	10.0.3.1	10.20.30.40
R1 processes	10.0.2.1 (R2)	8	10.0.1.1*	10.0.3.1	10.20.30.40
R2 processes	10.0.3.1 (R3)	12	10.0.1.1	10.0.2.1*	10.20.30.40
R3 processes	10.20.30.40 (B)	16	10.0.1.1	10.0.2.1	10.0.3.1*
Host B receives	10.20.30.40	16	10.0.1.1	10.0.2.1	10.0.3.1

Note: *asterisk indicates the address just recorded by that router

Observations:

The destination field changes at each hop (it's the "current target")
The route data transforms from forward path to recorded backward path
When Host B receives the packet, the route data shows R1→R2→R3 (the actual path)
Host B can use this recorded route to reply (reverse it for the return path)

ssr_example.txt
Step-by-step SSR packet transformation:
 
═══════════════════════════════════════════════════════════════
STAGE 1: Host A creates packet
═══════════════════════════════════════════════════════════════
Source IP:      192.168.1.10 (Host A)
Destination IP: 10.0.1.1 (R1) ← First hop goes in destination
SSR Option:     Type=137, Length=15, Pointer=4
Route Data:     [10.0.2.1] [10.0.3.1] [10.20.30.40]
                    ↑
                  Pointer (next to use)
 
═══════════════════════════════════════════════════════════════
STAGE 2: R1 receives packet (destination = R1's address)
═══════════════════════════════════════════════════════════════
R1 actions:
1. "Destination is me, but pointer (4) ≤ length (15)"
2. "Read next address at pointer position: 10.0.2.1"
3. "Is 10.0.2.1 directly reachable? YES (it's my neighbor)"
4. "Swap: destination ← 10.0.2.1, record my IP (10.0.1.1)"
5. "Advance pointer: 4 → 8"
 
After R1:
Destination IP: 10.0.2.1 (R2)
Route Data:     [10.0.1.1] [10.0.3.1] [10.20.30.40]
                 ↑recorded     ↑
                              Pointer
 
═══════════════════════════════════════════════════════════════
STAGE 3: R2 receives packet
═══════════════════════════════════════════════════════════════
R2 actions:
1. "Destination is me, pointer (8) ≤ length (15)"
2. "Read next address at pointer position: 10.0.3.1"
3. "Is 10.0.3.1 directly reachable? YES"
4. "Swap: destination ← 10.0.3.1, record my IP (10.0.2.1)"
5. "Advance pointer: 8 → 12"
 
After R2:
Destination IP: 10.0.3.1 (R3)
Route Data:     [10.0.1.1] [10.0.2.1] [10.20.30.40]
                            ↑recorded     ↑
                                        Pointer
 
═══════════════════════════════════════════════════════════════
STAGE 4: R3 receives packet
═══════════════════════════════════════════════════════════════
R3 actions:
1. "Destination is me, pointer (12) ≤ length (15)"
2. "Read next address at pointer position: 10.20.30.40"
3. "Is 10.20.30.40 directly reachable? YES (on my subnet)"
4. "Swap: destination ← 10.20.30.40, record my IP"
5. "Advance pointer: 12 → 16"
 
After R3:
Destination IP: 10.20.30.40 (Host B) ← Final destination!
Route Data:     [10.0.1.1] [10.0.2.1] [10.0.3.1]
Pointer:        16 > Length(15) → Route exhausted
 
═══════════════════════════════════════════════════════════════
STAGE 5: Host B receives packet
═══════════════════════════════════════════════════════════════
- Destination matches Host B's IP
- Pointer (16) > Length (15) → Final destination confirmed
- Route data now contains: R1 → R2 → R3 (reverse path for reply)
- Deliver to upper layer protocol

Implementation Details

Implementing strict source routing correctly requires careful attention to pointer arithmetic, direct reachability checking, and proper address swapping.

strict_source_routing.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
#include <stdint.h>
#include <stdbool.h>
#include <string.h>
 
#define OPT_SSR 137  // Strict Source Route type
 
typedef struct {
    uint32_t src_ip;
    uint32_t dst_ip;
    uint8_t options[40];
    uint8_t options_len;
} IPv4Packet;
 
typedef struct {
    uint32_t ip;
    uint32_t subnet_mask;
    uint32_t connected_networks[8];  // Directly connected network IPs
    int num_connected;
} RouterInterface;
 
/**
 * Check if an IP is directly reachable (STRICT requirement)
 * 
 * For Strict Source Routing, the next hop must be:
 * 1. On a directly connected network
 * 2. Reachable without going through another router
 */
bool is_directly_reachable(RouterInterface *interfaces, int num_if, 
                           uint32_t target_ip) {
    for (int i = 0; i < num_if; i++) {
        // Check if target is on same subnet as this interface
        uint32_t our_network = interfaces[i].ip & interfaces[i].subnet_mask;
        uint32_t target_network = target_ip & interfaces[i].subnet_mask;
        
        if (our_network == target_network) {
            // Target is on our directly connected network
            // (We can ARP for it directly)
            return true;
        }
    }
    return false;  // Would need to route through another router
}
 
/**
 * Process Strict Source Route option
 * 
 * @param packet       The IPv4 packet
 * @param my_ip        Our IP address (for recording)
 * @param interfaces   Our network interfaces
 * @param num_if       Number of interfaces
 * @return 0 on success, -1 on error (should send ICMP and drop)
 */
int process_ssr(IPv4Packet *packet, uint32_t my_ip,
                RouterInterface *interfaces, int num_if) {
    
    // Find SSR option in options area
    int offset = 0;
    while (offset < packet->options_len) {
        uint8_t type = packet->options[offset];
        
        if (type == 0) break;  // EOL
        if (type == 1) {       // NOP
            offset++;
            continue;
        }
        
        if (type == OPT_SSR) {
            // Found Strict Source Route option
            uint8_t length = packet->options[offset + 1];
            uint8_t pointer = packet->options[offset + 2];
            
            // Is this packet addressed to us?
            if (packet->dst_ip != my_ip) {
                // Not our concern yet - forward normally
                // (SSR only triggers when we're the destination)
                offset += length;
                continue;
            }
            
            // We're the destination - check if there's more route
            if (pointer > length) {
                // Route exhausted - we're the final destination
                return 0;  // Success - deliver to upper layer
            }
            
            // More route to go - get next hop
            int route_offset = offset + pointer - 1;  // Convert 1-indexed to 0-indexed
            
            if (route_offset + 4 > offset + length) {
                // Malformed option
                return -1;
            }
            
            // Extract next hop IP
            uint32_t next_hop;
            memcpy(&next_hop, &packet->options[route_offset], 4);
            next_hop = ntohl(next_hop);  // Network to host byte order
            
            // STRICT CHECK: Is next hop directly reachable?
            if (!is_directly_reachable(interfaces, num_if, next_hop)) {
                // STRICT ROUTE FAILED!
                // Should send ICMP Dest Unreachable, Code 5
                return -1;
            }
            
            // Good - perform the swap
            // 1. Record our IP where we read the next hop
            uint32_t my_ip_network = htonl(my_ip);
            memcpy(&packet->options[route_offset], &my_ip_network, 4);
            
            // 2. Set new destination
            packet->dst_ip = next_hop;
            
            // 3. Advance pointer
            packet->options[offset + 2] = pointer + 4;
            
            return 0;  // Success - forward to new destination
        }
        
        // Skip this option by its length
        uint8_t length = packet->options[offset + 1];
        offset += length;
    }
    
    return 0;  // No SSR found, normal processing
}

Error Handling and ICMP

When Strict Source Routing fails, routers generate ICMP error messages to inform the source. Understanding these errors is crucial for troubleshooting.

ICMP Destination Unreachable - Code 5: Source Route Failed

This specific code indicates the source route could not be followed. The ICMP message includes:

The IP header of the offending packet
Part of the original packet data
Enough information for the source to understand which hop failed

SSR Related ICMP Error Codes
ICMP Type	Code	Name	Cause
3 (Dest Unreachable)	5	Source Route Failed	Next hop not directly reachable
11 (Time Exceeded)	0	TTL Expired in Transit	Routing loop in source route
12 (Parameter Problem)	0	Pointer indicates error	Malformed SSR option

icmp_source_route_failed.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
#include <stdint.h>
 
// ICMP Type 3: Destination Unreachable
#define ICMP_DEST_UNREACHABLE 3
 
// Code 5: Source Route Failed
#define ICMP_CODE_SOURCE_ROUTE_FAILED 5
 
typedef struct __attribute__((packed)) {
    uint8_t type;
    uint8_t code;
    uint16_t checksum;
    uint32_t unused;           // Must be zero
    uint8_t original_header[]; // Variable: IP header + 8 bytes of original data
} ICMPDestUnreachable;
 
/**
 * Generate ICMP Source Route Failed message
 * 
 * Called when strict source routing cannot find direct path
 */
void send_source_route_failed(IPv4Packet *original, uint32_t our_ip) {
    ICMPDestUnreachable icmp;
    
    icmp.type = ICMP_DEST_UNREACHABLE;
    icmp.code = ICMP_CODE_SOURCE_ROUTE_FAILED;
    icmp.checksum = 0;  // Calculated later
    icmp.unused = 0;
    
    // Copy original IP header + first 8 bytes of data
    // This helps the source identify which packet failed
    // (Limited to 8 bytes per original RFC 792)
    
    // Build and send ICMP packet back to source...
    // (Implementation details omitted)
}

Diagnosing SSR Failures

When you receive 'Source Route Failed', the ICMP message tells you which router couldn't continue. Check: (1) Are the specified routers directly connected? (2) Is an intervening router missing from the route? (3) Has network topology changed since the route was planned?

Practical Considerations

Understanding when Strict Source Routing might be used (historically) and why it's largely obsolete helps contextualize this option.

Historical Use Cases:

Network Testing: Verify specific paths through a network
Policy Routing: Force traffic through monitoring or filtering points
Debugging: Isolate routing problems by controlling the path
Redundancy Testing: Verify backup paths work correctly

Why SSR Requires Complete Topology Knowledge:

To use SSR, you must know:

Every router in the path
The direct connections between them
Their IP addresses
That no topology changes have occurred

This makes SSR impractical for most real-world scenarios—you'd need network documentation that's rarely available and always current.

SSR Advantages

•Absolute path control
•Guaranteed route verification
•Useful for specific testing scenarios
•Records path as it travels
•Response can use reverse route

SSR Disadvantages

•Requires complete topology knowledge
•Brittle—any topology change breaks it
•Limited to 9 routers (40 byte limit)
•Blocked by most networks
•Major security vulnerability

Security Implications and Modern Status

Strict Source Routing presents severe security risks that have led to its near-universal blocking on modern networks.

Security Vulnerabilities:

Firewall Bypass: Attacker specifies route around security devices
IP Spoofing Facilitation: Source routing helps forge return paths
Network Reconnaissance: Mapping internal topology by probing routes
Man-in-the-Middle Setup: Force traffic through attacker-controlled points
Reflection Attacks: Route packets through victims for amplification

Warning: Security Critical

RFC 7126 (2014) and numerous security best practices recommend BLOCKING all source-routed packets at network borders. Most enterprise firewalls, ISPs, and cloud providers drop packets with SSR or LSR options by default. Never enable source routing processing unless you have an extremely specific, controlled use case.

Converting Mermaid diagram...

block_source_routing.txt
# Cisco IOS - Disable IP source routing (recommended)
Router(config)# no ip source-route
 
# Linux - Disable source routing at kernel level
echo 0 > /proc/sys/net/ipv4/accept_source_route
 
# Or permanently in /etc/sysctl.conf:
net.ipv4.accept_source_route = 0
 
# iptables - Drop source-routed packets
iptables -A INPUT -m ipv4options --ssrr -j DROP
iptables -A INPUT -m ipv4options --lsrr -j DROP
iptables -A FORWARD -m ipv4options --ssrr -j DROP
iptables -A FORWARD -m ipv4options --lsrr -j DROP
 
# Windows (registry)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
DisableIPSourceRouting = 2 (drop all source-routed packets)

Summary: Strict Source Routing

We've comprehensively covered Strict Source Routing. Let's consolidate the key points:

Key Takeaways

•SSR type value is 137 (0x89) — Copy flag is SET (copied to all fragments)
•'Strict' means direct connectivity — Each specified router must be directly reachable from the previous one
•Address swap mechanism — Destination field changes at each hop while route is recorded
•Pointer tracks progress — Starts at 4, advances by 4 at each hop
•ICMP Code 5 on failure — 'Source Route Failed' when strict requirement violated
•Maximum 9 intermediate routers — Due to 40-byte options limit
•Copied to fragments — Each fragment needs routing instructions
•Universally blocked today — Severe security implications led to widespread filtering

What's Next:

Now that you understand the strictest form of source routing, we'll explore Loose Source Routing—a more flexible variant that allows normal routing between specified waypoints. This relaxation makes LSR more practical but carries the same security concerns.

Page Complete

You now have complete knowledge of Strict Source Routing—its structure, processing algorithm, error handling, and security implications. While rarely used in practice, understanding SSR is essential for protocol analysis, security assessment, and historical context of IP design decisions.

Strict Source Routing Option

Taking Complete Control of Packet Paths

What You Will Learn

Understanding Source Routing

Source routing inverts the traditional routing paradigm. Instead of routers determining paths, the source host specifies the route.

Traditional Routing:

Source sends packet with destination address
Each router independently decides next hop
Path emerges from collective routing decisions
Source has no control over path taken

Source Routing:

Source specifies complete path in packet header
Each router follows instructions in the header
Path is predetermined by the sender
Routers act as directed forwarding agents

Converting Mermaid diagram...

Two Flavors of Source Routing:

IPv4 provides two source routing options with different strictness levels:

Option	Type Value	Behavior
Strict Source Routing	137 (0x89)	Must go directly through each specified router—no intermediate hops allowed
Loose Source Routing	131 (0x83)	Must visit each specified router, but normal routing allowed between them

This page focuses on Strict Source Routing (SSR). The next page covers Loose Source Routing (LSR).

Strict Source Routing Option Structure

The Strict Source Route (SSR) option, also called Strict Source and Record Route (SSRR), uses the same format as Record Route with similar semantics but different purpose.

+--------+--------+--------+--------+
|  Type  | Length | Pointer|        |
| (137)  |        |        | IP #1  |
+--------+--------+--------+--------+
|         IP Address #1             |
+-----------------------------------+
|         IP Address #2             |
+-----------------------------------+
|            ...                    |
+-----------------------------------+
|         IP Address #N             |
+-----------------------------------+

Option Identification:

Field	Value	Binary	Description
Type	137	10001001	SSR identifier
Copy Flag	1	bit 0	Copied to all fragments
Class	0	bits 1-2	Control option
Number	9	bits 3-7	Option number within class

Copy Flag Is Set

SSR Option Fields
Field	Size	Offset	Purpose
Type	1 byte	0	Value 137 (0x89) - identifies SSR
Length	1 byte	1	Total option length (3 + 4×N)
Pointer	1 byte	2	Points to next route address to use
Route Data	4×N bytes	3+	Sequence of router IP addresses

What Makes It "Strict"

The "strict" in Strict Source Routing means no intermediate hops are allowed between specified routers. Each router in the list must be directly reachable from the previous router.

Direct Reachability Requirement:

Router A and Router B are "directly connected" if they share a physical link or subnet
There can be NO intervening Layer 3 devices
Switches and bridges (Layer 2) are acceptable between them
Another router in between violates the strict requirement

Example Scenarios:

Valid Strict Route

•Specified: R1 → R2 → R3
•R1 directly connected to R2 ✓
•R2 directly connected to R3 ✓
•Packet successfully delivered
•Each hop is adjacent

Invalid Strict Route

•Specified: R1 → R3 (skipping R2)
•R1 NOT directly connected to R3 ✗
•R2 exists between them
•Packet DROPPED at R1
•ICMP error sent to source

Converting Mermaid diagram...

Error Condition

Router Processing Algorithm

When a router receives a packet with Strict Source Routing, it follows a specific algorithm that differs significantly from normal forwarding.

Processing Steps:

Check if we're the destination: Compare packet's destination IP with our interfaces
If NOT destination: Normal routing applies, but SSR processing still occurs
If we ARE the destination in header:
- Check pointer against length
- If pointer > length: We're the FINAL destination, deliver to upper layer
- If pointer ≤ length: We're an intermediate stop
Intermediate processing:
- Read next address from pointer position
- Strict check: Is next address DIRECTLY reachable?
- If NO: Send ICMP error, drop packet
- If YES: Swap destination address with next route entry
- Record our address in the route (replacing the one we just used)
- Advance pointer by 4
- Forward to new destination

Converting Mermaid diagram...

The Address Swap Mechanism:

This is the clever part of source routing. The packet's destination address changes at each hop:

Original destination holds the NEXT router to visit
When that router receives the packet, it:
- Takes its own address out of the route list
- Puts the FOLLOWING router into the destination field
- Records itself where the extracted address was
This continues until pointer exceeds length
At that point, the destination field contains the FINAL destination

This mechanism allows the packet to "walk" through the specified route while simultaneously recording the path taken.

Detailed Processing Example

Let's trace a packet through strict source routing step by step.

Scenario:

Host A (192.168.1.10) wants to reach Host B (10.20.30.40)
Strict route specified: via R1 (10.0.1.1) → R2 (10.0.2.1) → R3 (10.0.3.1)
All routers are directly connected in sequence

Packet State at Each Stage
Stage	IP Destination	Pointer	Route Data[0]	Route Data[1]	Route Data[2]
Host A sends	10.0.1.1 (R1)	4	10.0.2.1	10.0.3.1	10.20.30.40
R1 processes	10.0.2.1 (R2)	8	10.0.1.1*	10.0.3.1	10.20.30.40
R2 processes	10.0.3.1 (R3)	12	10.0.1.1	10.0.2.1*	10.20.30.40
R3 processes	10.20.30.40 (B)	16	10.0.1.1	10.0.2.1	10.0.3.1*
Host B receives	10.20.30.40	16	10.0.1.1	10.0.2.1	10.0.3.1

Note: *asterisk indicates the address just recorded by that router

Observations:

The destination field changes at each hop (it's the "current target")
The route data transforms from forward path to recorded backward path
When Host B receives the packet, the route data shows R1→R2→R3 (the actual path)
Host B can use this recorded route to reply (reverse it for the return path)

ssr_example.txt
Step-by-step SSR packet transformation:
 
═══════════════════════════════════════════════════════════════
STAGE 1: Host A creates packet
═══════════════════════════════════════════════════════════════
Source IP:      192.168.1.10 (Host A)
Destination IP: 10.0.1.1 (R1) ← First hop goes in destination
SSR Option:     Type=137, Length=15, Pointer=4
Route Data:     [10.0.2.1] [10.0.3.1] [10.20.30.40]
                    ↑
                  Pointer (next to use)
 
═══════════════════════════════════════════════════════════════
STAGE 2: R1 receives packet (destination = R1's address)
═══════════════════════════════════════════════════════════════
R1 actions:
1. "Destination is me, but pointer (4) ≤ length (15)"
2. "Read next address at pointer position: 10.0.2.1"
3. "Is 10.0.2.1 directly reachable? YES (it's my neighbor)"
4. "Swap: destination ← 10.0.2.1, record my IP (10.0.1.1)"
5. "Advance pointer: 4 → 8"
 
After R1:
Destination IP: 10.0.2.1 (R2)
Route Data:     [10.0.1.1] [10.0.3.1] [10.20.30.40]
                 ↑recorded     ↑
                              Pointer
 
═══════════════════════════════════════════════════════════════
STAGE 3: R2 receives packet
═══════════════════════════════════════════════════════════════
R2 actions:
1. "Destination is me, pointer (8) ≤ length (15)"
2. "Read next address at pointer position: 10.0.3.1"
3. "Is 10.0.3.1 directly reachable? YES"
4. "Swap: destination ← 10.0.3.1, record my IP (10.0.2.1)"
5. "Advance pointer: 8 → 12"
 
After R2:
Destination IP: 10.0.3.1 (R3)
Route Data:     [10.0.1.1] [10.0.2.1] [10.20.30.40]
                            ↑recorded     ↑
                                        Pointer
 
═══════════════════════════════════════════════════════════════
STAGE 4: R3 receives packet
═══════════════════════════════════════════════════════════════
R3 actions:
1. "Destination is me, pointer (12) ≤ length (15)"
2. "Read next address at pointer position: 10.20.30.40"
3. "Is 10.20.30.40 directly reachable? YES (on my subnet)"
4. "Swap: destination ← 10.20.30.40, record my IP"
5. "Advance pointer: 12 → 16"
 
After R3:
Destination IP: 10.20.30.40 (Host B) ← Final destination!
Route Data:     [10.0.1.1] [10.0.2.1] [10.0.3.1]
Pointer:        16 > Length(15) → Route exhausted
 
═══════════════════════════════════════════════════════════════
STAGE 5: Host B receives packet
═══════════════════════════════════════════════════════════════
- Destination matches Host B's IP
- Pointer (16) > Length (15) → Final destination confirmed
- Route data now contains: R1 → R2 → R3 (reverse path for reply)
- Deliver to upper layer protocol

Implementation Details

Implementing strict source routing correctly requires careful attention to pointer arithmetic, direct reachability checking, and proper address swapping.

strict_source_routing.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
#include <stdint.h>
#include <stdbool.h>
#include <string.h>
 
#define OPT_SSR 137  // Strict Source Route type
 
typedef struct {
    uint32_t src_ip;
    uint32_t dst_ip;
    uint8_t options[40];
    uint8_t options_len;
} IPv4Packet;
 
typedef struct {
    uint32_t ip;
    uint32_t subnet_mask;
    uint32_t connected_networks[8];  // Directly connected network IPs
    int num_connected;
} RouterInterface;
 
/**
 * Check if an IP is directly reachable (STRICT requirement)
 * 
 * For Strict Source Routing, the next hop must be:
 * 1. On a directly connected network
 * 2. Reachable without going through another router
 */
bool is_directly_reachable(RouterInterface *interfaces, int num_if, 
                           uint32_t target_ip) {
    for (int i = 0; i < num_if; i++) {
        // Check if target is on same subnet as this interface
        uint32_t our_network = interfaces[i].ip & interfaces[i].subnet_mask;
        uint32_t target_network = target_ip & interfaces[i].subnet_mask;
        
        if (our_network == target_network) {
            // Target is on our directly connected network
            // (We can ARP for it directly)
            return true;
        }
    }
    return false;  // Would need to route through another router
}
 
/**
 * Process Strict Source Route option
 * 
 * @param packet       The IPv4 packet
 * @param my_ip        Our IP address (for recording)
 * @param interfaces   Our network interfaces
 * @param num_if       Number of interfaces
 * @return 0 on success, -1 on error (should send ICMP and drop)
 */
int process_ssr(IPv4Packet *packet, uint32_t my_ip,
                RouterInterface *interfaces, int num_if) {
    
    // Find SSR option in options area
    int offset = 0;
    while (offset < packet->options_len) {
        uint8_t type = packet->options[offset];
        
        if (type == 0) break;  // EOL
        if (type == 1) {       // NOP
            offset++;
            continue;
        }
        
        if (type == OPT_SSR) {
            // Found Strict Source Route option
            uint8_t length = packet->options[offset + 1];
            uint8_t pointer = packet->options[offset + 2];
            
            // Is this packet addressed to us?
            if (packet->dst_ip != my_ip) {
                // Not our concern yet - forward normally
                // (SSR only triggers when we're the destination)
                offset += length;
                continue;
            }
            
            // We're the destination - check if there's more route
            if (pointer > length) {
                // Route exhausted - we're the final destination
                return 0;  // Success - deliver to upper layer
            }
            
            // More route to go - get next hop
            int route_offset = offset + pointer - 1;  // Convert 1-indexed to 0-indexed
            
            if (route_offset + 4 > offset + length) {
                // Malformed option
                return -1;
            }
            
            // Extract next hop IP
            uint32_t next_hop;
            memcpy(&next_hop, &packet->options[route_offset], 4);
            next_hop = ntohl(next_hop);  // Network to host byte order
            
            // STRICT CHECK: Is next hop directly reachable?
            if (!is_directly_reachable(interfaces, num_if, next_hop)) {
                // STRICT ROUTE FAILED!
                // Should send ICMP Dest Unreachable, Code 5
                return -1;
            }
            
            // Good - perform the swap
            // 1. Record our IP where we read the next hop
            uint32_t my_ip_network = htonl(my_ip);
            memcpy(&packet->options[route_offset], &my_ip_network, 4);
            
            // 2. Set new destination
            packet->dst_ip = next_hop;
            
            // 3. Advance pointer
            packet->options[offset + 2] = pointer + 4;
            
            return 0;  // Success - forward to new destination
        }
        
        // Skip this option by its length
        uint8_t length = packet->options[offset + 1];
        offset += length;
    }
    
    return 0;  // No SSR found, normal processing
}

Error Handling and ICMP

When Strict Source Routing fails, routers generate ICMP error messages to inform the source. Understanding these errors is crucial for troubleshooting.

ICMP Destination Unreachable - Code 5: Source Route Failed

This specific code indicates the source route could not be followed. The ICMP message includes:

The IP header of the offending packet
Part of the original packet data
Enough information for the source to understand which hop failed

SSR Related ICMP Error Codes
ICMP Type	Code	Name	Cause
3 (Dest Unreachable)	5	Source Route Failed	Next hop not directly reachable
11 (Time Exceeded)	0	TTL Expired in Transit	Routing loop in source route
12 (Parameter Problem)	0	Pointer indicates error	Malformed SSR option

icmp_source_route_failed.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
#include <stdint.h>
 
// ICMP Type 3: Destination Unreachable
#define ICMP_DEST_UNREACHABLE 3
 
// Code 5: Source Route Failed
#define ICMP_CODE_SOURCE_ROUTE_FAILED 5
 
typedef struct __attribute__((packed)) {
    uint8_t type;
    uint8_t code;
    uint16_t checksum;
    uint32_t unused;           // Must be zero
    uint8_t original_header[]; // Variable: IP header + 8 bytes of original data
} ICMPDestUnreachable;
 
/**
 * Generate ICMP Source Route Failed message
 * 
 * Called when strict source routing cannot find direct path
 */
void send_source_route_failed(IPv4Packet *original, uint32_t our_ip) {
    ICMPDestUnreachable icmp;
    
    icmp.type = ICMP_DEST_UNREACHABLE;
    icmp.code = ICMP_CODE_SOURCE_ROUTE_FAILED;
    icmp.checksum = 0;  // Calculated later
    icmp.unused = 0;
    
    // Copy original IP header + first 8 bytes of data
    // This helps the source identify which packet failed
    // (Limited to 8 bytes per original RFC 792)
    
    // Build and send ICMP packet back to source...
    // (Implementation details omitted)
}

Diagnosing SSR Failures

Practical Considerations

Understanding when Strict Source Routing might be used (historically) and why it's largely obsolete helps contextualize this option.

Historical Use Cases:

Network Testing: Verify specific paths through a network
Policy Routing: Force traffic through monitoring or filtering points
Debugging: Isolate routing problems by controlling the path
Redundancy Testing: Verify backup paths work correctly

Why SSR Requires Complete Topology Knowledge:

To use SSR, you must know:

Every router in the path
The direct connections between them
Their IP addresses
That no topology changes have occurred

This makes SSR impractical for most real-world scenarios—you'd need network documentation that's rarely available and always current.

SSR Advantages

•Absolute path control
•Guaranteed route verification
•Useful for specific testing scenarios
•Records path as it travels
•Response can use reverse route

SSR Disadvantages

•Requires complete topology knowledge
•Brittle—any topology change breaks it
•Limited to 9 routers (40 byte limit)
•Blocked by most networks
•Major security vulnerability

Security Implications and Modern Status

Strict Source Routing presents severe security risks that have led to its near-universal blocking on modern networks.

Security Vulnerabilities:

Firewall Bypass: Attacker specifies route around security devices
IP Spoofing Facilitation: Source routing helps forge return paths
Network Reconnaissance: Mapping internal topology by probing routes
Man-in-the-Middle Setup: Force traffic through attacker-controlled points
Reflection Attacks: Route packets through victims for amplification

Warning: Security Critical

Converting Mermaid diagram...

block_source_routing.txt
# Cisco IOS - Disable IP source routing (recommended)
Router(config)# no ip source-route
 
# Linux - Disable source routing at kernel level
echo 0 > /proc/sys/net/ipv4/accept_source_route
 
# Or permanently in /etc/sysctl.conf:
net.ipv4.accept_source_route = 0
 
# iptables - Drop source-routed packets
iptables -A INPUT -m ipv4options --ssrr -j DROP
iptables -A INPUT -m ipv4options --lsrr -j DROP
iptables -A FORWARD -m ipv4options --ssrr -j DROP
iptables -A FORWARD -m ipv4options --lsrr -j DROP
 
# Windows (registry)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
DisableIPSourceRouting = 2 (drop all source-routed packets)

Summary: Strict Source Routing

We've comprehensively covered Strict Source Routing. Let's consolidate the key points:

Key Takeaways

•SSR type value is 137 (0x89) — Copy flag is SET (copied to all fragments)
•'Strict' means direct connectivity — Each specified router must be directly reachable from the previous one
•Address swap mechanism — Destination field changes at each hop while route is recorded
•Pointer tracks progress — Starts at 4, advances by 4 at each hop
•ICMP Code 5 on failure — 'Source Route Failed' when strict requirement violated
•Maximum 9 intermediate routers — Due to 40-byte options limit
•Copied to fragments — Each fragment needs routing instructions
•Universally blocked today — Severe security implications led to widespread filtering

What's Next:

Page Complete