Abstract: In one embodiment, a non-transitory processor-readable medium stores code representing instructions to cause a processor to determine (1) whether an IPv6 packet includes an extension header of an illegal type and (2) a quantity of extension headers present in the IPv6 packet that are of a preselected type. When the IPv6 packet includes the extension header of the illegal type, the code can send a first signal to block transmission of the IPv6 packet. When the quantity of extension headers that are of the preselected type is greater than a preselected quantity, the code can send a second signal to block transmission of the IPv6 packet.

Abstract: In some embodiments, a non-transitory processor-readable medium storing code representing instructions to cause a processor to perform a process includes code to determine whether an IPv4 packet is associated with a Domain Name System (DNS) query based on an IPv4 header of the IPv4 packet. If the IPv4 packet is a DNS query packet, the non-transitory processor-readable medium includes code to determine whether the IPv4 packet has a preselected query type based on a payload of the IPv4 packet. If the IPv4 packet is a DNS query packet and has the preselected query type, the non-transitory processor-readable medium includes code to send a signal to block transmission of the IPv4 packet. In some embodiments, the preselected query type has a DNS record type value of 28.

Abstract: In one embodiment, a non-transitory processor-readable medium stores code representing instructions to cause a processor to determine whether an IPv4 payload of an IPv4 packet includes a tunneled IPv6 packet. When the IPv4 payload includes the tunneled IPv6 packet, the code can determine a location of a payload of the tunneled IPv6 packet based at least in part on a header of the tunneled IPv6 packet, and send a signal to block transmission of the IPv4 packet when the payload of the tunneled IPv6 packet is not a valid IPv6 payload.