In what order should IPv6 extension headers appear, and why does ordering matter?
There's a recommended fixed order (Hop-by-Hop first, then routing, fragment, authentication, ESP, destination options) so each node processes only the headers meant for it, in the right sequence.
The recommended sequence is roughly:
- Hop-by-Hop Options (must be first — examined by every router on the path)
- Destination Options (for the first destination)
- Routing
- Fragment
- Authentication (AH)
- Encapsulating Security Payload (ESP)
- Destination Options (for the final destination)
Order matters because the Hop-by-Hop header must be read by every hop, so it has to come first; security headers (AH/ESP) need to wrap the right portion of the packet; and a receiver processes them in sequence. Following the order avoids ambiguity and lets routers stop early once they've seen what concerns them.
Tip: Hop-by-Hop = "everyone reads this"; everything else is generally only for the destination — which is why Hop-by-Hop is mandated to be first.
Go deeper:
RFC 8200 §4 — IPv6 Extension Headers — the recommended header order and the chaining rules, straight from the spec.- IPv6 packet — Extension headers (Wikipedia) — the extension-header table with type numbers at a glance.