@@ -, +, @@ 
 (source, examples, and tests)
--- a/examples/routing/manet-routing-compare.cc	
+++ a/examples/routing/manet-routing-compare.cc	
@@ -120,24 +120,22 @@ RoutingExperiment::RoutingExperiment ()
 std::string
 PrintReceivedPacket (Ptr<Socket> socket, Ptr<Packet> packet)
 {
-  SocketAddressTag tag;
-  bool found;
-  found = packet->PeekPacketTag (tag);
+  Ptr<const SocketAddressTag> tag = packet->PeekPacketTag<SocketAddressTag> ();
   std::ostringstream oss;
 
   oss << Simulator::Now ().GetSeconds () << " " << socket->GetNode ()->GetId ();
 
-  if (found)
-    {
-      InetSocketAddress addr = InetSocketAddress::ConvertFrom (tag.GetAddress ());
+  if (tag != 0)
+        {
+      InetSocketAddress addr = InetSocketAddress::ConvertFrom (tag->GetAddress ());
       oss << " received one packet from " << addr.GetIpv4 ();
-    }
-  else
-    {
+        }
+      else
+        {
       oss << " received one packet!";
-    }
+        }
   return oss.str ();
-}
+    }
 
 void
 RoutingExperiment::ReceivePacket (Ptr<Socket> socket)
@@ -148,7 +146,7 @@ RoutingExperiment::ReceivePacket (Ptr<Socket> socket)
       bytesTotal += packet->GetSize ();
       packetsReceived += 1;
       NS_LOG_UNCOND (PrintReceivedPacket (socket, packet));
-    }
+}
 }
 
 void
--- a/src/aodv/model/aodv-routing-protocol.cc	
+++ a/src/aodv/model/aodv-routing-protocol.cc	
@@ -352,9 +352,9 @@ RoutingProtocol::RouteOutput (Ptr<Packet> p, const Ipv4Header &header,
   // Actual route request will be deferred until packet will be fully formed, 
   // routed to loopback, received from loopback and passed to RouteInput (see below)
   uint32_t iif = (oif ? m_ipv4->GetInterfaceForDevice (oif) : -1);
-  DeferredRouteOutputTag tag (iif);
-  if (!p->PeekPacketTag (tag))
+  if (p->PeekPacketTag<DeferredRouteOutputTag> () == 0)
     {
+      Ptr<DeferredRouteOutputTag> tag = CreateObject<DeferredRouteOutputTag> (iif);
       p->AddPacketTag (tag);
     }
   return LoopbackRoute (header, oif);
@@ -405,8 +405,7 @@ RoutingProtocol::RouteInput (Ptr<const Packet> p, const Ipv4Header &header,
   // Deferred route request
   if (idev == m_lo)
     {
-      DeferredRouteOutputTag tag;
-      if (p->PeekPacketTag (tag))
+      if (p->PeekPacketTag<DeferredRouteOutputTag> () != 0)
         {
           DeferredRouteOutput (p, header, ucb, ecb);
           return true;
@@ -1594,11 +1593,11 @@ RoutingProtocol::SendPacketFromQueue (Ipv4Address dst, Ptr<Ipv4Route> route)
   QueueEntry queueEntry;
   while (m_queue.Dequeue (dst, queueEntry))
     {
-      DeferredRouteOutputTag tag;
       Ptr<Packet> p = ConstCast<Packet> (queueEntry.GetPacket ());
-      if (p->RemovePacketTag (tag) && 
-          tag.GetInterface() != -1 &&
-          tag.GetInterface() != m_ipv4->GetInterfaceForDevice (route->GetOutputDevice ()))
+      Ptr<const DeferredRouteOutputTag> tag = p->RemovePacketTag<DeferredRouteOutputTag> ();
+      if (tag != 0 && 
+          tag->GetInterface() != -1 && 
+          tag->GetInterface() != m_ipv4->GetInterfaceForDevice (route->GetOutputDevice ()))
         {
           NS_LOG_DEBUG ("Output device doesn't match. Dropped.");
           return;
--- a/src/applications/model/radvd.cc	
+++ a/src/applications/model/radvd.cc	
@@ -211,8 +211,8 @@ void Radvd::Send (Ptr<RadvdInterface> config, Ipv6Address dst, bool reschedule)
   /* Router advertisements MUST always have a ttl of 255
    * The ttl value should be set as a socket option, but this is not yet implemented
    */
-  SocketIpTtlTag ttl;
-  ttl.SetTtl (255);
+  Ptr<SocketIpTtlTag> ttl = CreateObject<SocketIpTtlTag> ();
+  ttl->SetTtl (255);
   p->AddPacketTag (ttl);
 
   /* send RA */
--- a/src/dsdv/model/dsdv-routing-protocol.cc	
+++ a/src/dsdv/model/dsdv-routing-protocol.cc	
@@ -317,10 +317,9 @@ RoutingProtocol::RouteOutput (Ptr<Packet> p,
   if (EnableBuffering)
     {
       uint32_t iif = (oif ? m_ipv4->GetInterfaceForDevice (oif) : -1);
-      DeferredRouteOutputTag tag (iif);
-      if (!p->PeekPacketTag (tag))
+      if (p->PeekPacketTag<DeferredRouteOutputTag> () == 0)
         {
-          p->AddPacketTag (tag);
+          p->AddPacketTag (CreateObject<DeferredRouteOutputTag> (iif));
         }
     }
   return LoopbackRoute (header,oif);
@@ -377,8 +376,7 @@ RoutingProtocol::RouteInput (Ptr<const Packet> p,
   // Deferred route request
   if (EnableBuffering == true && idev == m_lo)
     {
-      DeferredRouteOutputTag tag;
-      if (p->PeekPacketTag (tag))
+      if (p->PeekPacketTag<DeferredRouteOutputTag> () != 0)
         {
           DeferredRouteOutput (p,header,ucb,ecb);
           return true;
@@ -1121,11 +1119,11 @@ RoutingProtocol::SendPacketFromQueue (Ipv4Address dst,
   QueueEntry queueEntry;
   if (m_queue.Dequeue (dst,queueEntry))
     {
-      DeferredRouteOutputTag tag;
       Ptr<Packet> p = ConstCast<Packet> (queueEntry.GetPacket ());
-      if (p->RemovePacketTag (tag))
+      Ptr<const DeferredRouteOutputTag> tag = p->RemovePacketTag<DeferredRouteOutputTag> ();
+      if (tag != 0)
         {
-          if (tag.oif != -1 && tag.oif != m_ipv4->GetInterfaceForDevice (route->GetOutputDevice ()))
+          if (tag->oif != -1 && tag->oif != m_ipv4->GetInterfaceForDevice (route->GetOutputDevice ()))
             {
               NS_LOG_DEBUG ("Output device doesn't match. Dropped.");
               return;
--- a/src/flow-monitor/model/ipv4-flow-probe.cc	
+++ a/src/flow-monitor/model/ipv4-flow-probe.cc	
@@ -204,8 +204,8 @@ Ipv4FlowProbe::SendOutgoingLogger (const Ipv4Header &ipHeader, Ptr<const Packet>
 
       // tag the packet with the flow id and packet id, so that the packet can be identified even
       // when Ipv4Header is not accessible at some non-IPv4 protocol layer
-      Ipv4FlowProbeTag fTag (flowId, packetId, size);
-      ipPayload->AddPacketTag (fTag);
+      Ptr<Ipv4FlowProbeTag> fTag = CreateObject<Ipv4FlowProbeTag> (flowId, packetId, size);
+      ConstCast<Packet> (ipPayload)->AddPacketTag (fTag);
     }
 }
 
@@ -233,10 +233,9 @@ Ipv4FlowProbe::ForwardUpLogger (const Ipv4Header &ipHeader, Ptr<const Packet> ip
   if (m_classifier->Classify (ipHeader, ipPayload, &flowId, &packetId))
     {
       // remove the tags that are added by Ipv4FlowProbe::SendOutgoingLogger ()
-      Ipv4FlowProbeTag fTag;
 
       // ConstCast: see http://www.nsnam.org/bugzilla/show_bug.cgi?id=904
-      ConstCast<Packet> (ipPayload)->RemovePacketTag (fTag);
+      ConstCast<Packet> (ipPayload)->RemovePacketTag<Ipv4FlowProbeTag> ();
 
       uint32_t size = (ipPayload->GetSize () + ipHeader.GetSerializedSize ());
       NS_LOG_DEBUG ("ReportLastRx ("<<this<<", "<<flowId<<", "<<packetId<<", "<<size<<");");
@@ -272,10 +271,9 @@ Ipv4FlowProbe::DropLogger (const Ipv4Header &ipHeader, Ptr<const Packet> ipPaylo
   if (m_classifier->Classify (ipHeader, ipPayload, &flowId, &packetId))
     {
       // remove the tags that are added by Ipv4FlowProbe::SendOutgoingLogger ()
-      Ipv4FlowProbeTag fTag;
 
       // ConstCast: see http://www.nsnam.org/bugzilla/show_bug.cgi?id=904
-      ConstCast<Packet> (ipPayload)->RemovePacketTag (fTag);
+      ConstCast<Packet> (ipPayload)->RemovePacketTag<Ipv4FlowProbeTag> ();
 
       uint32_t size = (ipPayload->GetSize () + ipHeader.GetSerializedSize ());
       NS_LOG_DEBUG ("Drop ("<<this<<", "<<flowId<<", "<<packetId<<", "<<size<<", " << reason 
@@ -325,19 +323,17 @@ void
 Ipv4FlowProbe::QueueDropLogger (Ptr<const Packet> ipPayload)
 {
   // remove the tags that are added by Ipv4FlowProbe::SendOutgoingLogger ()
-  Ipv4FlowProbeTag fTag;
 
   // ConstCast: see http://www.nsnam.org/bugzilla/show_bug.cgi?id=904
-  bool tagFound;
-  tagFound = ConstCast<Packet> (ipPayload)->RemovePacketTag (fTag);
+  Ptr<const Ipv4FlowProbeTag> fTag = ConstCast<Packet> (ipPayload)->RemovePacketTag<Ipv4FlowProbeTag> ();
   if (!tagFound)
     {
       return;
     }
 
-  FlowId flowId = fTag.GetFlowId ();
-  FlowPacketId packetId = fTag.GetPacketId ();
-  uint32_t size = fTag.GetPacketSize ();
+  FlowId flowId = fTag->GetFlowId ();
+  FlowPacketId packetId = fTag->GetPacketId ();
+  uint32_t size = fTag->GetPacketSize ();
 
   NS_LOG_DEBUG ("Drop ("<<this<<", "<<flowId<<", "<<packetId<<", "<<size<<", " << DROP_QUEUE 
                         << "); ");
--- a/src/internet/model/icmpv6-l4-protocol.cc	
+++ a/src/internet/model/icmpv6-l4-protocol.cc	
@@ -846,10 +846,10 @@ void Icmpv6L4Protocol::SendMessage (Ptr<Packet> packet, Ipv6Address src, Ipv6Add
 {
   NS_LOG_FUNCTION (this << packet << src << dst << (uint32_t)ttl);
   Ptr<Ipv6L3Protocol> ipv6 = m_node->GetObject<Ipv6L3Protocol> ();
-  SocketIpTtlTag tag;
   NS_ASSERT (ipv6 != 0);
 
-  tag.SetTtl (ttl);
+  Ptr<SocketIpTtlTag> tag = CreateObject<SocketIpTtlTag> ();
+  tag->SetTtl (ttl);
   packet->AddPacketTag (tag);
   m_downTarget (packet, src, dst, PROT_NUMBER, 0);
 }
@@ -860,7 +860,6 @@ void Icmpv6L4Protocol::SendMessage (Ptr<Packet> packet, Ipv6Address dst, Icmpv6H
   Ptr<Ipv6L3Protocol> ipv6 = m_node->GetObject<Ipv6L3Protocol> ();
   NS_ASSERT (ipv6 != 0 && ipv6->GetRoutingProtocol () != 0);
   Ipv6Header header;
-  SocketIpTtlTag tag;
   Socket::SocketErrno err;
   Ptr<Ipv6Route> route;
   Ptr<NetDevice> oif (0); //specify non-zero if bound to a source address
@@ -871,7 +870,8 @@ void Icmpv6L4Protocol::SendMessage (Ptr<Packet> packet, Ipv6Address dst, Icmpv6H
   if (route != 0)
     {
       NS_LOG_LOGIC ("Route exists");
-      tag.SetTtl (ttl);
+      Ptr<SocketIpTtlTag> tag = CreateObject<SocketIpTtlTag> ();
+      tag->SetTtl (ttl);
       packet->AddPacketTag (tag);
       Ipv6Address src = route->GetSource ();
 
--- a/src/internet/model/ipv4-l3-protocol.cc	
+++ a/src/internet/model/ipv4-l3-protocol.cc	
@@ -547,11 +547,10 @@ Ipv4L3Protocol::Send (Ptr<Packet> packet,
   Ipv4Header ipHeader;
   bool mayFragment = true;
   uint8_t ttl = m_defaultTtl;
-  SocketIpTtlTag tag;
-  bool found = packet->RemovePacketTag (tag);
-  if (found)
+  Ptr<const SocketIpTtlTag> tag = packet->RemovePacketTag<SocketIpTtlTag> ();
+  if (tag != 0)
     {
-      ttl = tag.GetTtl ();
+      ttl = tag->GetTtl ();
     }
 
   // Handle a few cases:
--- a/src/internet/model/ipv4-raw-socket-impl.cc	
+++ a/src/internet/model/ipv4-raw-socket-impl.cc	
@@ -320,9 +320,10 @@ Ipv4RawSocketImpl::ForwardUp (Ptr<const Packet> p, Ipv4Header ipHeader, Ptr<Ipv4
       // Should check via getsockopt ()..
       if (IsRecvPktInfo ())
         {
-          Ipv4PacketInfoTag tag;
-          copy->RemovePacketTag (tag);
-          tag.SetRecvIf (incomingInterface->GetDevice ()->GetIfIndex ());
+          Ptr<const Ipv4PacketInfoTag> origTag = copy->RemovePacketTag<Ipv4PacketInfoTag> ();
+          NS_ASSERT (origTag != 0);
+          Ptr<Ipv4PacketInfoTag> tag = CreateObject<Ipv4PacketInfoTag> (*origTag);
+          tag->SetRecvIf (incomingInterface->GetDevice ()->GetIfIndex ());
           copy->AddPacketTag (tag);
         }
       if (m_protocol == 1)
--- a/src/internet/model/ipv6-l3-protocol.cc	
+++ a/src/internet/model/ipv6-l3-protocol.cc	
@@ -610,12 +610,11 @@ void Ipv6L3Protocol::Send (Ptr<Packet> packet, Ipv6Address source, Ipv6Address d
   NS_LOG_FUNCTION (this << packet << source << destination << (uint32_t)protocol << route);
   Ipv6Header hdr;
   uint8_t ttl = m_defaultTtl;
-  SocketIpTtlTag tag;
-  bool found = packet->RemovePacketTag (tag);
+  Ptr<const SocketIpTtlTag> tag = packet->RemovePacketTag<SocketIpTtlTag> ();
 
-  if (found)
+  if (tag != 0)
     {
-      ttl = tag.GetTtl ();
+      ttl = tag->GetTtl ();
     }
 
   /* Handle 3 cases:
--- a/src/internet/model/ipv6-raw-socket-impl.cc	
+++ a/src/internet/model/ipv6-raw-socket-impl.cc	
@@ -340,9 +340,9 @@ bool Ipv6RawSocketImpl::ForwardUp (Ptr<const Packet> p, Ipv6Header hdr, Ptr<NetD
       // Should check via getsockopt ()..
       if (IsRecvPktInfo ())
         {
-          Ipv6PacketInfoTag tag;
-          copy->RemovePacketTag (tag);
-          tag.SetRecvIf (device->GetIfIndex ());
+          Ptr<const Ipv6PacketInfoTag> origTag = copy->RemovePacketTag<Ipv6PacketInfoTag> ();
+          Ptr<Ipv6PacketInfoTag> tag = CreateObject<Ipv6PacketInfoTag> (*origTag);
+          tag->SetRecvIf (device->GetIfIndex ());
           copy->AddPacketTag (tag);
         }
 
--- a/src/internet/model/tcp-socket-base.cc	
+++ a/src/internet/model/tcp-socket-base.cc	
@@ -269,7 +269,7 @@ TcpSocketBase::Bind6 (void)
     {
       m_errno = ERROR_ADDRNOTAVAIL;
       return -1;
-    }
+}
   m_tcp->m_sockets.push_back (this);
   return SetupCallback ();
 }
@@ -281,30 +281,30 @@ TcpSocketBase::Bind (const Address &address)
   NS_LOG_FUNCTION (this << address);
   if (InetSocketAddress::IsMatchingType (address))
     {
-      InetSocketAddress transport = InetSocketAddress::ConvertFrom (address);
-      Ipv4Address ipv4 = transport.GetIpv4 ();
-      uint16_t port = transport.GetPort ();
-      if (ipv4 == Ipv4Address::GetAny () && port == 0)
-        {
-          m_endPoint = m_tcp->Allocate ();
-        }
-      else if (ipv4 == Ipv4Address::GetAny () && port != 0)
-        {
-          m_endPoint = m_tcp->Allocate (port);
-        }
-      else if (ipv4 != Ipv4Address::GetAny () && port == 0)
-        {
-          m_endPoint = m_tcp->Allocate (ipv4);
-        }
-      else if (ipv4 != Ipv4Address::GetAny () && port != 0)
-        {
-          m_endPoint = m_tcp->Allocate (ipv4, port);
-        }
-      if (0 == m_endPoint)
-        {
-          m_errno = port ? ERROR_ADDRINUSE : ERROR_ADDRNOTAVAIL;
-          return -1;
-        }
+  InetSocketAddress transport = InetSocketAddress::ConvertFrom (address);
+  Ipv4Address ipv4 = transport.GetIpv4 ();
+  uint16_t port = transport.GetPort ();
+  if (ipv4 == Ipv4Address::GetAny () && port == 0)
+    {
+      m_endPoint = m_tcp->Allocate ();
+    }
+  else if (ipv4 == Ipv4Address::GetAny () && port != 0)
+    {
+      m_endPoint = m_tcp->Allocate (port);
+    }
+  else if (ipv4 != Ipv4Address::GetAny () && port == 0)
+    {
+      m_endPoint = m_tcp->Allocate (ipv4);
+    }
+  else if (ipv4 != Ipv4Address::GetAny () && port != 0)
+    {
+      m_endPoint = m_tcp->Allocate (ipv4, port);
+    }
+  if (0 == m_endPoint)
+    {
+      m_errno = port ? ERROR_ADDRINUSE : ERROR_ADDRNOTAVAIL;
+      return -1;
+    }
     }
   else if (Inet6SocketAddress::IsMatchingType (address))
     {
@@ -353,24 +353,24 @@ TcpSocketBase::Connect (const Address & address)
   // If haven't do so, Bind() this socket first
   if (InetSocketAddress::IsMatchingType (address) && m_endPoint6 == 0)
     {
-      if (m_endPoint == 0)
+  if (m_endPoint == 0)
+    {
+      if (Bind () == -1)
         {
-          if (Bind () == -1)
-            {
-              NS_ASSERT (m_endPoint == 0);
-              return -1; // Bind() failed
-            }
-          NS_ASSERT (m_endPoint != 0);
+          NS_ASSERT (m_endPoint == 0);
+          return -1; // Bind() failed
         }
-      InetSocketAddress transport = InetSocketAddress::ConvertFrom (address);
-      m_endPoint->SetPeer (transport.GetIpv4 (), transport.GetPort ());
+      NS_ASSERT (m_endPoint != 0);
+    }
+  InetSocketAddress transport = InetSocketAddress::ConvertFrom (address);
+  m_endPoint->SetPeer (transport.GetIpv4 (), transport.GetPort ());
       m_endPoint6 = 0;
 
-      // Get the appropriate local address and port number from the routing protocol and set up endpoint
-      if (SetupEndpoint () != 0)
-        { // Route to destination does not exist
-          return -1;
-        }
+  // Get the appropriate local address and port number from the routing protocol and set up endpoint
+  if (SetupEndpoint () != 0)
+    { // Route to destination does not exist
+      return -1;
+    }
     }
   else if (Inet6SocketAddress::IsMatchingType (address)  && m_endPoint == 0)
     {
@@ -381,7 +381,7 @@ TcpSocketBase::Connect (const Address & address)
       if (v6Addr.IsIpv4MappedAddress () == true)
         {
           Ipv4Address v4Addr = v6Addr.GetIpv4MappedAddress ();
-          return Connect (InetSocketAddress (v4Addr, transport.GetPort ()));
+          return Connect(InetSocketAddress(v4Addr, transport.GetPort ()));
         }
 
       if (m_endPoint6 == 0)
@@ -526,15 +526,16 @@ TcpSocketBase::Recv (uint32_t maxSize, uint32_t flags)
   Ptr<Packet> outPacket = m_rxBuffer.Extract (maxSize);
   if (outPacket != 0 && outPacket->GetSize () != 0)
     {
-      SocketAddressTag tag;
+      Ptr<SocketAddressTag> tag = CreateObject<SocketAddressTag> ();
       if (m_endPoint != 0)
         {
-          tag.SetAddress (InetSocketAddress (m_endPoint->GetPeerAddress (), m_endPoint->GetPeerPort ()));
+          tag->SetAddress (InetSocketAddress (m_endPoint->GetPeerAddress (), m_endPoint->GetPeerPort ()));
         }
       else if (m_endPoint6 != 0)
         {
-          tag.SetAddress (Inet6SocketAddress (m_endPoint6->GetPeerAddress (), m_endPoint6->GetPeerPort ()));
+          tag->SetAddress (Inet6SocketAddress (m_endPoint6->GetPeerAddress (), m_endPoint6->GetPeerPort ()));
         }
+      
       outPacket->AddPacketTag (tag);
     }
   return outPacket;
@@ -621,7 +622,7 @@ TcpSocketBase::BindToNetDevice (Ptr<NetDevice> netdevice)
 
   if (m_endPoint != 0)
     {
-      m_endPoint->BindToNetDevice (netdevice);
+  m_endPoint->BindToNetDevice (netdevice);
     }
   // No BindToNetDevice() for Ipv6EndPoint
   return;
@@ -639,8 +640,8 @@ TcpSocketBase::SetupCallback (void)
     }
   if (m_endPoint != 0)
     {
-      m_endPoint->SetRxCallback (MakeCallback (&TcpSocketBase::ForwardUp, Ptr<TcpSocketBase> (this)));
-      m_endPoint->SetDestroyCallback (MakeCallback (&TcpSocketBase::Destroy, Ptr<TcpSocketBase> (this)));
+  m_endPoint->SetRxCallback (MakeCallback (&TcpSocketBase::ForwardUp, Ptr<TcpSocketBase> (this)));
+  m_endPoint->SetDestroyCallback (MakeCallback (&TcpSocketBase::Destroy, Ptr<TcpSocketBase> (this)));
     }
   if (m_endPoint6 != 0)
     {
@@ -791,7 +792,7 @@ TcpSocketBase::DoForwardUp (Ptr<Packet> packet, Ipv4Header header, uint16_t port
   TcpHeader tcpHeader;
   packet->RemoveHeader (tcpHeader);
   if (tcpHeader.GetFlags () & TcpHeader::ACK)
-    {
+    { 
       EstimateRtt (tcpHeader);
     }
   ReadOptions (tcpHeader);
@@ -810,7 +811,7 @@ TcpSocketBase::DoForwardUp (Ptr<Packet> packet, Ipv4Header header, uint16_t port
     {
       NS_LOG_LOGIC ("At state " << TcpStateName[m_state] <<
                     " received packet of seq [" << tcpHeader.GetSequenceNumber () <<
-                    ":" << tcpHeader.GetSequenceNumber () + packet->GetSize () <<
+                    ":" << tcpHeader.GetSequenceNumber () + packet->GetSize() <<
                     ") out of range [" << m_rxBuffer.NextRxSequence () << ":" <<
                     m_rxBuffer.MaxRxSequence () << ")");
       // Acknowledgement should be sent for all unacceptable packets (RFC793, p.69)
@@ -905,7 +906,7 @@ TcpSocketBase::DoForwardUp (Ptr<Packet> packet, Ipv6Address saddr, Ipv6Address d
     {
       NS_LOG_LOGIC ("At state " << TcpStateName[m_state] <<
                     " received packet of seq [" << tcpHeader.GetSequenceNumber () <<
-                    ":" << tcpHeader.GetSequenceNumber () + packet->GetSize () <<
+                    ":" << tcpHeader.GetSequenceNumber () + packet->GetSize() <<
                     ") out of range [" << m_rxBuffer.NextRxSequence () << ":" <<
                     m_rxBuffer.MaxRxSequence () << ")");
       // Acknowledgement should be sent for all unacceptable packets (RFC793, p.69)
@@ -1130,7 +1131,7 @@ TcpSocketBase::ProcessSynSent (Ptr<Packet> packet, const TcpHeader& tcpHeader)
     { // Other in-sequence input
       if (tcpflags != TcpHeader::RST)
         { // When (1) rx of FIN+ACK; (2) rx of FIN; (3) rx of bad flags
-          NS_LOG_LOGIC ("Illegal flag " << std::hex << static_cast<uint32_t> (tcpflags) << std::dec << " received. Reset packet is sent.");
+          NS_LOG_LOGIC ("Illegal flag " << std::hex << static_cast<uint32_t>(tcpflags) << std::dec << " received. Reset packet is sent.");
           SendRST ();
         }
       CloseAndNotify ();
@@ -1149,7 +1150,7 @@ TcpSocketBase::ProcessSynRcvd (Ptr<Packet> packet, const TcpHeader& tcpHeader,
 
   if (tcpflags == 0
       || (tcpflags == TcpHeader::ACK
-          && m_nextTxSequence + SequenceNumber32 (1) == tcpHeader.GetAckNumber ()))
+       && m_nextTxSequence + SequenceNumber32 (1) == tcpHeader.GetAckNumber ()))
     { // If it is bare data, accept it and move to ESTABLISHED state. This is
       // possibly due to ACK lost in 3WHS. If in-sequence ACK is received, the
       // handshake is completed nicely.
@@ -1161,8 +1162,8 @@ TcpSocketBase::ProcessSynRcvd (Ptr<Packet> packet, const TcpHeader& tcpHeader,
       m_txBuffer.SetHeadSequence (m_nextTxSequence);
       if (m_endPoint)
         {
-          m_endPoint->SetPeer (InetSocketAddress::ConvertFrom (fromAddress).GetIpv4 (),
-                               InetSocketAddress::ConvertFrom (fromAddress).GetPort ());
+      m_endPoint->SetPeer (InetSocketAddress::ConvertFrom (fromAddress).GetIpv4 (),
+                           InetSocketAddress::ConvertFrom (fromAddress).GetPort ());
         }
       else if (m_endPoint6)
         {
@@ -1195,8 +1196,8 @@ TcpSocketBase::ProcessSynRcvd (Ptr<Packet> packet, const TcpHeader& tcpHeader,
           m_txBuffer.SetHeadSequence (m_nextTxSequence);
           if (m_endPoint)
             {
-              m_endPoint->SetPeer (InetSocketAddress::ConvertFrom (fromAddress).GetIpv4 (),
-                                   InetSocketAddress::ConvertFrom (fromAddress).GetPort ());
+          m_endPoint->SetPeer (InetSocketAddress::ConvertFrom (fromAddress).GetIpv4 (),
+                               InetSocketAddress::ConvertFrom (fromAddress).GetPort ());
             }
           else if (m_endPoint6)
             {
@@ -1213,8 +1214,8 @@ TcpSocketBase::ProcessSynRcvd (Ptr<Packet> packet, const TcpHeader& tcpHeader,
           NS_LOG_LOGIC ("Illegal flag " << tcpflags << " received. Reset packet is sent.");
           if (m_endPoint)
             {
-              m_endPoint->SetPeer (InetSocketAddress::ConvertFrom (fromAddress).GetIpv4 (),
-                                   InetSocketAddress::ConvertFrom (fromAddress).GetPort ());
+          m_endPoint->SetPeer (InetSocketAddress::ConvertFrom (fromAddress).GetIpv4 (),
+                               InetSocketAddress::ConvertFrom (fromAddress).GetPort ());
             }
           else if (m_endPoint6)
             {
@@ -1294,9 +1295,9 @@ TcpSocketBase::ProcessWait (Ptr<Packet> packet, const TcpHeader& tcpHeader)
       if (!m_shutdownRecv)
         {
           NotifyDataRecv ();
-        }
     }
 }
+}
 
 /** Received a packet upon CLOSING */
 void
@@ -1450,12 +1451,12 @@ TcpSocketBase::Destroy (void)
   m_endPoint = 0;
   if (m_tcp != 0)
     {
-      std::vector<Ptr<TcpSocketBase> >::iterator it
-        = std::find (m_tcp->m_sockets.begin (), m_tcp->m_sockets.end (), this);
-      if (it != m_tcp->m_sockets.end ())
-        {
-          m_tcp->m_sockets.erase (it);
-        }
+  std::vector<Ptr<TcpSocketBase> >::iterator it
+    = std::find (m_tcp->m_sockets.begin (), m_tcp->m_sockets.end (), this);
+  if (it != m_tcp->m_sockets.end ())
+    {
+      m_tcp->m_sockets.erase (it);
+    }
     }
   NS_LOG_LOGIC (this << " Cancelled ReTxTimeout event which was set to expire at " <<
                 (Simulator::Now () + Simulator::GetDelayLeft (m_retxEvent)).GetSeconds ());
@@ -1511,8 +1512,8 @@ TcpSocketBase::SendEmptyPacket (uint8_t flags)
   header.SetAckNumber (m_rxBuffer.NextRxSequence ());
   if (m_endPoint != 0)
     {
-      header.SetSourcePort (m_endPoint->GetLocalPort ());
-      header.SetDestinationPort (m_endPoint->GetPeerPort ());
+  header.SetSourcePort (m_endPoint->GetLocalPort ());
+  header.SetDestinationPort (m_endPoint->GetPeerPort ());
     }
   else
     {
@@ -1601,7 +1602,7 @@ TcpSocketBase::DeallocateEndPoint (void)
       if (it != m_tcp->m_sockets.end ())
         {
           m_tcp->m_sockets.erase (it);
-        }
+}
       CancelAllTimers ();
     }
 }
@@ -1677,10 +1678,10 @@ TcpSocketBase::CompleteFork (Ptr<Packet> p, const TcpHeader& h,
   // Get port and address from peer (connecting host)
   if (InetSocketAddress::IsMatchingType (toAddress))
     {
-      m_endPoint = m_tcp->Allocate (InetSocketAddress::ConvertFrom (toAddress).GetIpv4 (),
-                                    InetSocketAddress::ConvertFrom (toAddress).GetPort (),
-                                    InetSocketAddress::ConvertFrom (fromAddress).GetIpv4 (),
-                                    InetSocketAddress::ConvertFrom (fromAddress).GetPort ());
+  m_endPoint = m_tcp->Allocate (InetSocketAddress::ConvertFrom (toAddress).GetIpv4 (),
+                                InetSocketAddress::ConvertFrom (toAddress).GetPort (),
+                                InetSocketAddress::ConvertFrom (fromAddress).GetIpv4 (),
+                                InetSocketAddress::ConvertFrom (fromAddress).GetPort ());
       m_endPoint6 = 0;
     }
   else if (Inet6SocketAddress::IsMatchingType (toAddress))
@@ -1748,8 +1749,8 @@ TcpSocketBase::SendDataPacket (SequenceNumber32 seq, uint32_t maxSize, bool with
   header.SetAckNumber (m_rxBuffer.NextRxSequence ());
   if (m_endPoint)
     {
-      header.SetSourcePort (m_endPoint->GetLocalPort ());
-      header.SetDestinationPort (m_endPoint->GetPeerPort ());
+  header.SetSourcePort (m_endPoint->GetLocalPort ());
+  header.SetDestinationPort (m_endPoint->GetPeerPort ());
     }
   else
     {
@@ -1769,8 +1770,8 @@ TcpSocketBase::SendDataPacket (SequenceNumber32 seq, uint32_t maxSize, bool with
   NS_LOG_LOGIC ("Send packet via TcpL4Protocol with flags 0x" << std::hex << static_cast<uint32_t> (flags) << std::dec);
   if (m_endPoint)
     {
-      m_tcp->SendPacket (p, header, m_endPoint->GetLocalAddress (),
-                         m_endPoint->GetPeerAddress (), m_boundnetdevice);
+  m_tcp->SendPacket (p, header, m_endPoint->GetLocalAddress (),
+                     m_endPoint->GetPeerAddress (), m_boundnetdevice);
     }
   else
     {
@@ -2061,8 +2062,8 @@ TcpSocketBase::PersistTimeout ()
   tcpHeader.SetWindowSize (AdvertisedWindowSize ());
   if (m_endPoint != 0)
     {
-      tcpHeader.SetSourcePort (m_endPoint->GetLocalPort ());
-      tcpHeader.SetDestinationPort (m_endPoint->GetPeerPort ());
+  tcpHeader.SetSourcePort (m_endPoint->GetLocalPort ());
+  tcpHeader.SetDestinationPort (m_endPoint->GetPeerPort ());
     }
   else
     {
@@ -2073,8 +2074,8 @@ TcpSocketBase::PersistTimeout ()
 
   if (m_endPoint != 0)
     {
-      m_tcp->SendPacket (p, tcpHeader, m_endPoint->GetLocalAddress (),
-                         m_endPoint->GetPeerAddress (), m_boundnetdevice);
+  m_tcp->SendPacket (p, tcpHeader, m_endPoint->GetLocalAddress (),
+                     m_endPoint->GetPeerAddress (), m_boundnetdevice);
     }
   else
     {
@@ -2149,7 +2150,7 @@ TcpSocketBase::TimeWait ()
   CancelAllTimers ();
   // Move from TIME_WAIT to CLOSED after 2*MSL. Max segment lifetime is 2 min
   // according to RFC793, p.28
-  m_timewaitEvent = Simulator::Schedule (Seconds (2 * m_msl),
+  m_timewaitEvent = Simulator::Schedule (Seconds (2*m_msl),
                                          &TcpSocketBase::CloseAndNotify, this);
 }
 
--- a/src/internet/model/udp-socket-impl.cc	
+++ a/src/internet/model/udp-socket-impl.cc	
@@ -180,9 +180,9 @@ UdpSocketImpl::FinishBind (void)
   bool done = false;
   if (m_endPoint != 0)
     {
-      m_endPoint->SetRxCallback (MakeCallback (&UdpSocketImpl::ForwardUp, Ptr<UdpSocketImpl> (this)));
-      m_endPoint->SetIcmpCallback (MakeCallback (&UdpSocketImpl::ForwardIcmp, Ptr<UdpSocketImpl> (this)));
-      m_endPoint->SetDestroyCallback (MakeCallback (&UdpSocketImpl::Destroy, Ptr<UdpSocketImpl> (this)));
+  m_endPoint->SetRxCallback (MakeCallback (&UdpSocketImpl::ForwardUp, Ptr<UdpSocketImpl> (this)));
+  m_endPoint->SetIcmpCallback (MakeCallback (&UdpSocketImpl::ForwardIcmp, Ptr<UdpSocketImpl> (this)));
+  m_endPoint->SetDestroyCallback (MakeCallback (&UdpSocketImpl::Destroy, Ptr<UdpSocketImpl> (this)));
       done = true;
     }
   if (m_endPoint6 != 0)
@@ -194,8 +194,8 @@ UdpSocketImpl::FinishBind (void)
     }
   if (done)
     {
-      return 0;
-    }
+  return 0;
+}
   return -1;
 }
 
@@ -207,7 +207,7 @@ UdpSocketImpl::Bind (void)
   return FinishBind ();
 }
 
-int
+int 
 UdpSocketImpl::Bind6 (void)
 {
   NS_LOG_FUNCTION_NOARGS ();
@@ -222,25 +222,25 @@ UdpSocketImpl::Bind (const Address &address)
 
   if (InetSocketAddress::IsMatchingType (address))
     {
-      InetSocketAddress transport = InetSocketAddress::ConvertFrom (address);
-      Ipv4Address ipv4 = transport.GetIpv4 ();
-      uint16_t port = transport.GetPort ();
-      if (ipv4 == Ipv4Address::GetAny () && port == 0)
-        {
-          m_endPoint = m_udp->Allocate ();
-        }
-      else if (ipv4 == Ipv4Address::GetAny () && port != 0)
-        {
-          m_endPoint = m_udp->Allocate (port);
-        }
-      else if (ipv4 != Ipv4Address::GetAny () && port == 0)
-        {
-          m_endPoint = m_udp->Allocate (ipv4);
-        }
-      else if (ipv4 != Ipv4Address::GetAny () && port != 0)
-        {
-          m_endPoint = m_udp->Allocate (ipv4, port);
-        }
+  InetSocketAddress transport = InetSocketAddress::ConvertFrom (address);
+  Ipv4Address ipv4 = transport.GetIpv4 ();
+  uint16_t port = transport.GetPort ();
+  if (ipv4 == Ipv4Address::GetAny () && port == 0)
+    {
+      m_endPoint = m_udp->Allocate ();
+    }
+  else if (ipv4 == Ipv4Address::GetAny () && port != 0)
+    {
+      m_endPoint = m_udp->Allocate (port);
+    }
+  else if (ipv4 != Ipv4Address::GetAny () && port == 0)
+    {
+      m_endPoint = m_udp->Allocate (ipv4);
+    }
+  else if (ipv4 != Ipv4Address::GetAny () && port != 0)
+    {
+      m_endPoint = m_udp->Allocate (ipv4, port);
+    }
     }
   else if (Inet6SocketAddress::IsMatchingType (address))
     {
@@ -310,11 +310,11 @@ UdpSocketImpl::Connect (const Address & address)
   NS_LOG_FUNCTION (this << address);
   if (InetSocketAddress::IsMatchingType(address) == true)
     {
-      InetSocketAddress transport = InetSocketAddress::ConvertFrom (address);
+  InetSocketAddress transport = InetSocketAddress::ConvertFrom (address);
       m_defaultAddress = Address(transport.GetIpv4 ());
-      m_defaultPort = transport.GetPort ();
-      m_connected = true;
-      NotifyConnectionSucceeded ();
+  m_defaultPort = transport.GetPort ();
+  m_connected = true;
+  NotifyConnectionSucceeded ();
     }
   else if (Inet6SocketAddress::IsMatchingType(address) == true)
     {
@@ -393,11 +393,11 @@ UdpSocketImpl::DoSendTo (Ptr<Packet> p, const Address &address)
       NS_LOG_LOGIC ("Not connected");
       if (InetSocketAddress::IsMatchingType(address) == true)
         {
-          InetSocketAddress transport = InetSocketAddress::ConvertFrom (address);
-          Ipv4Address ipv4 = transport.GetIpv4 ();
-          uint16_t port = transport.GetPort ();
-          return DoSendTo (p, ipv4, port);
-        }
+      InetSocketAddress transport = InetSocketAddress::ConvertFrom (address);
+      Ipv4Address ipv4 = transport.GetIpv4 ();
+      uint16_t port = transport.GetPort ();
+      return DoSendTo (p, ipv4, port);
+    }
       else if (Inet6SocketAddress::IsMatchingType(address) == true)
         {
           Inet6SocketAddress transport = Inet6SocketAddress::ConvertFrom (address);
@@ -405,8 +405,8 @@ UdpSocketImpl::DoSendTo (Ptr<Packet> p, const Address &address)
           uint16_t port = transport.GetPort ();
           return DoSendTo (p, ipv6, port);
         }
-      else
-        {
+  else
+    {
           return -1;
         }
     }
@@ -417,11 +417,11 @@ UdpSocketImpl::DoSendTo (Ptr<Packet> p, const Address &address)
       if (Ipv4Address::IsMatchingType(m_defaultAddress))
         {
           return DoSendTo (p, Ipv4Address::ConvertFrom(m_defaultAddress), m_defaultPort);
-        }
+    }
       else if (Ipv6Address::IsMatchingType(m_defaultAddress))
         {
           return DoSendTo (p, Ipv6Address::ConvertFrom(m_defaultAddress), m_defaultPort);
-        }
+}
     }
   m_errno = ERROR_AFNOSUPPORT;
   return(-1);
@@ -468,28 +468,29 @@ UdpSocketImpl::DoSendTo (Ptr<Packet> p, Ipv4Address dest, uint16_t port)
   // the same as a unicast, but it will be fixed further down the stack
   if (m_ipMulticastTtl != 0 && dest.IsMulticast ())
     {
-      SocketIpTtlTag tag;
-      tag.SetTtl (m_ipMulticastTtl);
+      Ptr<SocketIpTtlTag> tag = CreateObject<SocketIpTtlTag> ();
+      tag->SetTtl (m_ipMulticastTtl);
       p->AddPacketTag (tag);
     }
   else if (m_ipTtl != 0 && !dest.IsMulticast () && !dest.IsBroadcast ())
     {
-      SocketIpTtlTag tag;
-      tag.SetTtl (m_ipTtl);
+      Ptr<SocketIpTtlTag> tag = CreateObject<SocketIpTtlTag> ();
+      tag->SetTtl (m_ipTtl);
       p->AddPacketTag (tag);
     }
   {
-    SocketSetDontFragmentTag tag;
-    bool found = p->RemovePacketTag (tag);
-    if (!found)
+
+    // !!! Previously, header was removed, checked, but never added back.  Guess, this was wrong
+    if (p->PeekPacketTag<SocketSetDontFragmentTag> () == 0)
       {
+        Ptr<SocketSetDontFragmentTag> tag = CreateObject<SocketSetDontFragmentTag> ();
         if (m_mtuDiscover)
           {
-            tag.Enable ();
+            tag->Enable ();
           }
         else
           {
-            tag.Disable ();
+            tag->Disable ();
           }
         p->AddPacketTag (tag);
       }
@@ -656,14 +657,14 @@ UdpSocketImpl::DoSendTo (Ptr<Packet> p, Ipv6Address dest, uint16_t port)
   // the same as a unicast, but it will be fixed further down the stack
   if (m_ipMulticastTtl != 0 && dest.IsMulticast ())
     {
-      SocketIpTtlTag tag;
-      tag.SetTtl (m_ipMulticastTtl);
+      Ptr<SocketIpTtlTag> tag = CreateObject<SocketIpTtlTag> ();
+      tag->SetTtl (m_ipMulticastTtl);
       p->AddPacketTag (tag);
     }
   else if (m_ipTtl != 0 && !dest.IsMulticast ())
     {
-      SocketIpTtlTag tag;
-      tag.SetTtl (m_ipTtl);
+      Ptr<SocketIpTtlTag> tag = CreateObject<SocketIpTtlTag> ();
+      tag->SetTtl (m_ipTtl);
       p->AddPacketTag (tag);
     }
   // There is no analgous to an IPv4 broadcast address in IPv6.
@@ -734,11 +735,11 @@ UdpSocketImpl::SendTo (Ptr<Packet> p, uint32_t flags, const Address &address)
   NS_LOG_FUNCTION (this << p << flags << address);
   if (InetSocketAddress::IsMatchingType (address))
     {
-      InetSocketAddress transport = InetSocketAddress::ConvertFrom (address);
-      Ipv4Address ipv4 = transport.GetIpv4 ();
-      uint16_t port = transport.GetPort ();
-      return DoSendTo (p, ipv4, port);
-    }
+  InetSocketAddress transport = InetSocketAddress::ConvertFrom (address);
+  Ipv4Address ipv4 = transport.GetIpv4 ();
+  uint16_t port = transport.GetPort ();
+  return DoSendTo (p, ipv4, port);
+}
   else if (Inet6SocketAddress::IsMatchingType (address))
     {
       Inet6SocketAddress transport = Inet6SocketAddress::ConvertFrom (address);
@@ -788,11 +789,9 @@ UdpSocketImpl::RecvFrom (uint32_t maxSize, uint32_t flags,
   Ptr<Packet> packet = Recv (maxSize, flags);
   if (packet != 0)
     {
-      SocketAddressTag tag;
-      bool found;
-      found = packet->PeekPacketTag (tag);
-      NS_ASSERT (found);
-      fromAddress = tag.GetAddress ();
+      Ptr<const SocketAddressTag> tag = packet->PeekPacketTag<SocketAddressTag> ();
+      NS_ASSERT (tag != 0);
+      fromAddress = tag->GetAddress ();
     }
   return packet;
 }
@@ -874,17 +873,17 @@ UdpSocketImpl::ForwardUp (Ptr<Packet> packet, Ipv4Header header, uint16_t port,
   // Should check via getsockopt ()..
   if (IsRecvPktInfo ())
     {
-      Ipv4PacketInfoTag tag;
-      packet->RemovePacketTag (tag);
-      tag.SetRecvIf (incomingInterface->GetDevice ()->GetIfIndex ());
+      Ptr<const Ipv4PacketInfoTag> origTag = packet->RemovePacketTag<Ipv4PacketInfoTag> ();
+      Ptr<Ipv4PacketInfoTag> tag = CreateObject<Ipv4PacketInfoTag> (*origTag);      
+      tag->SetRecvIf (incomingInterface->GetDevice ()->GetIfIndex ());
       packet->AddPacketTag (tag);
     }
 
   if ((m_rxAvailable + packet->GetSize ()) <= m_rcvBufSize)
     {
       Address address = InetSocketAddress (header.GetSource (), port);
-      SocketAddressTag tag;
-      tag.SetAddress (address);
+      Ptr<SocketAddressTag> tag = CreateObject<SocketAddressTag> ();
+      tag->SetAddress (address);
       packet->AddPacketTag (tag);
       m_deliveryQueue.push (packet);
       m_rxAvailable += packet->GetSize ();
@@ -902,7 +901,7 @@ UdpSocketImpl::ForwardUp (Ptr<Packet> packet, Ipv4Header header, uint16_t port,
     }
 }
 
-void 
+void
 UdpSocketImpl::ForwardUp6 (Ptr<Packet> packet, Ipv6Address saddr, Ipv6Address daddr, uint16_t port)
 {
   NS_LOG_FUNCTION (this << packet << saddr << port);
@@ -915,8 +914,8 @@ UdpSocketImpl::ForwardUp6 (Ptr<Packet> packet, Ipv6Address saddr, Ipv6Address da
   if ((m_rxAvailable + packet->GetSize ()) <= m_rcvBufSize)
     {
       Address address = Inet6SocketAddress (saddr, port);
-      SocketAddressTag tag;
-      tag.SetAddress (address);
+      Ptr<SocketAddressTag> tag = CreateObject<SocketAddressTag> ();
+      tag->SetAddress (address);
       packet->AddPacketTag (tag);
       m_deliveryQueue.push (packet);
       m_rxAvailable += packet->GetSize ();
--- a/src/mesh/model/dot11s/hwmp-protocol-mac.cc	
+++ a/src/mesh/model/dot11s/hwmp-protocol-mac.cc	
@@ -55,8 +55,7 @@ HwmpProtocolMac::ReceiveData (Ptr<Packet> packet, const WifiMacHeader & header)
   NS_ASSERT (header.IsData ());
 
   MeshHeader meshHdr;
-  HwmpTag tag;
-  if (packet->PeekPacketTag (tag))
+  if (packet->PeekPacketTag<HwmpTag> () != 0)
     {
       NS_FATAL_ERROR ("HWMP tag is not supposed to be received by network");
     }
@@ -78,8 +77,9 @@ HwmpProtocolMac::ReceiveData (Ptr<Packet> packet, const WifiMacHeader & header)
       NS_FATAL_ERROR (
         "6-address scheme is not yet supported and 4-address extension is not supposed to be used for data frames.");
     }
-  tag.SetSeqno (meshHdr.GetMeshSeqno ());
-  tag.SetTtl (meshHdr.GetMeshTtl ());
+  Ptr<HwmpTag> tag = CreateObject<HwmpTag> ();
+  tag->SetSeqno (meshHdr.GetMeshSeqno ());
+  tag->SetTtl (meshHdr.GetMeshTtl ());
   packet->AddPacketTag (tag);
 
   if ((destination == Mac48Address::GetBroadcast ()) && (m_protocol->DropDataFrame (meshHdr.GetMeshSeqno (),
@@ -188,19 +188,18 @@ HwmpProtocolMac::UpdateOutcomingFrame (Ptr<Packet> packet, WifiMacHeader & heade
     {
       return true;
     }
-  HwmpTag tag;
-  bool tagExists = packet->RemovePacketTag (tag);
-  if (!tagExists)
+  Ptr<const HwmpTag> tag = packet->RemovePacketTag<HwmpTag> ();
+  if (tag == 0)
     {
       NS_FATAL_ERROR ("HWMP tag must exist at this point");
     }
   m_stats.txData++;
   m_stats.txDataBytes += packet->GetSize ();
   MeshHeader meshHdr;
-  meshHdr.SetMeshSeqno (tag.GetSeqno ());
-  meshHdr.SetMeshTtl (tag.GetTtl ());
+  meshHdr.SetMeshSeqno (tag->GetSeqno ());
+  meshHdr.SetMeshTtl (tag->GetTtl ());
   packet->AddHeader (meshHdr);
-  header.SetAddr1 (tag.GetAddress ());
+  header.SetAddr1 (tag->GetAddress ());
   return true;
 }
 WifiActionHeader
--- a/src/mesh/model/dot11s/hwmp-protocol.cc	
+++ a/src/mesh/model/dot11s/hwmp-protocol.cc	
@@ -233,29 +233,32 @@ HwmpProtocol::RequestRoute (
   )
 {
   Ptr <Packet> packet = constPacket->Copy ();
-  HwmpTag tag;
+  Ptr<HwmpTag> tag = 0;
   if (sourceIface == GetMeshPoint ()->GetIfIndex ())
     {
       // packet from level 3
-      if (packet->PeekPacketTag (tag))
+      if (packet->PeekPacketTag<HwmpTag> () != 0)
         {
           NS_FATAL_ERROR ("HWMP tag has come with a packet from upper layer. This must not occur...");
         }
+      tag = CreateObject<HwmpTag> ();
       //Filling TAG:
       if (destination == Mac48Address::GetBroadcast ())
         {
-          tag.SetSeqno (m_dataSeqno++);
+          tag->SetSeqno (m_dataSeqno++);
         }
-      tag.SetTtl (m_maxTtl);
+      tag->SetTtl (m_maxTtl);
     }
   else
     {
-      if (!packet->RemovePacketTag (tag))
+      Ptr<const HwmpTag> origTag = packet->RemovePacketTag<HwmpTag> ();
+      if (!packet->RemovePacketTag<HwmpTag> ())
         {
           NS_FATAL_ERROR ("HWMP tag is supposed to be here at this point.");
         }
-      tag.DecrementTtl ();
-      if (tag.GetTtl () == 0)
+      tag = CreateObject<HwmpTag> (*origTag);
+      tag->DecrementTtl ();
+      if (tag->GetTtl () == 0)
         {
           m_stats.droppedTtl++;
           return false;
@@ -287,11 +290,11 @@ HwmpProtocol::RequestRoute (
             {
               Ptr<Packet> packetCopy = packet->Copy ();
               //
-              // 64-bit Intel valgrind complains about tag.SetAddress (*i).  It
+              // 64-bit Intel valgrind complains about tag->SetAddress (*i).  It
               // likes this just fine.
               //
               Mac48Address address = *i;
-              tag.SetAddress (address);
+              tag->SetAddress (address);
               packetCopy->AddPacketTag (tag);
               routeReply (true, packetCopy, source, destination, protocolType, plugin->first);
             }
@@ -299,7 +302,7 @@ HwmpProtocol::RequestRoute (
     }
   else
     {
-      return ForwardUnicast (sourceIface, source, destination, packet, protocolType, routeReply, tag.GetTtl ());
+      return ForwardUnicast (sourceIface, source, destination, packet, protocolType, routeReply, tag->GetTtl ());
     }
   return true;
 }
@@ -307,8 +310,8 @@ bool
 HwmpProtocol::RemoveRoutingStuff (uint32_t fromIface, const Mac48Address source,
                                   const Mac48Address destination, Ptr<Packet>  packet, uint16_t&  protocolType)
 {
-  HwmpTag tag;
-  if (!packet->RemovePacketTag (tag))
+  Ptr<const HwmpTag> tag = packet->RemovePacketTag<HwmpTag> ();
+  if (tag == 0)
     {
       NS_FATAL_ERROR ("HWMP tag must exist when packet received from the network");
     }
@@ -325,9 +328,9 @@ HwmpProtocol::ForwardUnicast (uint32_t  sourceIface, const Mac48Address source,
     {
       result = m_rtable->LookupProactive ();
     }
-  HwmpTag tag;
-  tag.SetAddress (result.retransmitter);
-  tag.SetTtl (ttl);
+  Ptr<HwmpTag> tag = CreateObject<HwmpTag> ();
+  tag->SetAddress (result.retransmitter);
+  tag->SetTtl (ttl);
   //seqno and metric is not used;
   packet->AddPacketTag (tag);
   if (result.retransmitter != Mac48Address::GetBroadcast ())
@@ -921,9 +924,13 @@ HwmpProtocol::ReactivePathResolved (Mac48Address dst)
   while (packet.pkt != 0)
     {
       //set RA tag for retransmitter:
-      HwmpTag tag;
-      packet.pkt->RemovePacketTag (tag);
-      tag.SetAddress (result.retransmitter);
+      Ptr<const HwmpTag> origTag = packet.pkt->RemovePacketTag<HwmpTag> ();
+      if (origTag == 0)
+        {
+          NS_FATAL_ERROR ("HWMP tag must be present at this point");
+        }
+      Ptr<HwmpTag> tag = CreateObject<HwmpTag> (*origTag);
+      tag->SetAddress (result.retransmitter);
       packet.pkt->AddPacketTag (tag);
       m_stats.txUnicast++;
       m_stats.txBytes += packet.pkt->GetSize ();
@@ -942,12 +949,13 @@ HwmpProtocol::ProactivePathResolved ()
   while (packet.pkt != 0)
     {
       //set RA tag for retransmitter:
-      HwmpTag tag;
-      if (!packet.pkt->RemovePacketTag (tag))
+      Ptr<const HwmpTag> origTag = packet.pkt->RemovePacketTag<HwmpTag> ();
+      if (origTag == 0)
         {
           NS_FATAL_ERROR ("HWMP tag must be present at this point");
         }
-      tag.SetAddress (result.retransmitter);
+      Ptr<HwmpTag> tag = CreateObject<HwmpTag> (*origTag);
+      tag->SetAddress (result.retransmitter);
       packet.pkt->AddPacketTag (tag);
       m_stats.txUnicast++;
       m_stats.txBytes += packet.pkt->GetSize ();
--- a/src/mesh/model/dot11s/hwmp-tag.cc	
+++ a/src/mesh/model/dot11s/hwmp-tag.cc	
@@ -41,7 +41,7 @@ HwmpTag::SetAddress (Mac48Address retransmitter)
 }
 
 Mac48Address
-HwmpTag::GetAddress ()
+HwmpTag::GetAddress () const
 {
   return m_address;
 }
@@ -53,7 +53,7 @@ HwmpTag::SetTtl (uint8_t ttl)
 }
 
 uint8_t
-HwmpTag::GetTtl ()
+HwmpTag::GetTtl () const
 {
   return m_ttl;
 }
@@ -65,7 +65,7 @@ HwmpTag::SetMetric (uint32_t metric)
 }
 
 uint32_t
-HwmpTag::GetMetric ()
+HwmpTag::GetMetric () const
 {
   return m_metric;
 }
@@ -77,7 +77,7 @@ HwmpTag::SetSeqno (uint32_t seqno)
 }
 
 uint32_t
-HwmpTag::GetSeqno ()
+HwmpTag::GetSeqno () const
 {
   return m_seqno;
 }
--- a/src/mesh/model/dot11s/hwmp-tag.h	
+++ a/src/mesh/model/dot11s/hwmp-tag.h	
@@ -51,13 +51,13 @@ public:
   HwmpTag ();
   ~HwmpTag ();
   void  SetAddress (Mac48Address retransmitter);
-  Mac48Address GetAddress ();
+  Mac48Address GetAddress () const;
   void  SetTtl (uint8_t ttl);
-  uint8_t GetTtl ();
+  uint8_t GetTtl () const;
   void  SetMetric (uint32_t metric);
-  uint32_t GetMetric ();
+  uint32_t GetMetric () const;
   void  SetSeqno (uint32_t seqno);
-  uint32_t GetSeqno ();
+  uint32_t GetSeqno () const;
   void  DecrementTtl ();
 
   static  TypeId  GetTypeId ();
--- a/src/mesh/model/flame/flame-protocol-mac.cc	
+++ a/src/mesh/model/flame/flame-protocol-mac.cc	
@@ -47,14 +47,14 @@ FlameProtocolMac::Receive (Ptr<Packet> packet, const WifiMacHeader & header)
     {
       return true;
     }
-  FlameTag tag;
-  if (packet->PeekPacketTag (tag))
+  if (packet->PeekPacketTag<FlameTag> () != 0)
     {
       NS_FATAL_ERROR ("FLAME tag is not supposed to be received by network");
     }
-  tag.receiver = header.GetAddr1 ();
-  tag.transmitter = header.GetAddr2 ();
-  if (tag.receiver == Mac48Address::GetBroadcast ())
+  Ptr<FlameTag> tag = CreateObject<FlameTag> ();
+  tag->receiver = header.GetAddr1 ();
+  tag->transmitter = header.GetAddr2 ();
+  if (tag->receiver == Mac48Address::GetBroadcast ())
     {
       m_stats.rxBroadcast++;
     }
@@ -74,13 +74,13 @@ FlameProtocolMac::UpdateOutcomingFrame (Ptr<Packet> packet, WifiMacHeader & head
     {
       return true;
     }
-  FlameTag tag;
-  if (!packet->RemovePacketTag (tag))
+  Ptr<const FlameTag> tag = packet->RemovePacketTag<FlameTag> ();
+  if (tag == 0)
     {
       NS_FATAL_ERROR ("FLAME tag must exist here");
     }
-  header.SetAddr1 (tag.receiver);
-  if (tag.receiver == Mac48Address::GetBroadcast ())
+  header.SetAddr1 (tag->receiver);
+  if (tag->receiver == Mac48Address::GetBroadcast ())
     {
       m_stats.txBroadcast++;
     }
--- a/src/mesh/model/flame/flame-protocol.cc	
+++ a/src/mesh/model/flame/flame-protocol.cc	
@@ -150,8 +150,7 @@ FlameProtocol::RequestRoute (uint32_t sourceIface, const Mac48Address source, co
   if (sourceIface == m_mp->GetIfIndex ())
     {
       //Packet from upper layer!
-      FlameTag tag;
-      if (packet->PeekPacketTag (tag))
+      if (packet->PeekPacketTag<FlameTag> () != 0)
         {
           NS_FATAL_ERROR ("FLAME tag is not supposed to be received from upper layers");
         }
@@ -174,7 +173,8 @@ FlameProtocol::RequestRoute (uint32_t sourceIface, const Mac48Address source, co
       flameHdr.SetOrigSrc (source);
       m_stats.txBytes += packet->GetSize ();
       packet->AddHeader (flameHdr);
-      tag.receiver = result.retransmitter;
+      Ptr<FlameTag> tag = CreateObject<FlameTag> ();
+      tag->receiver = result.retransmitter;
       if (result.retransmitter == Mac48Address::GetBroadcast ())
         {
           m_stats.txBroadcast++;
@@ -183,7 +183,7 @@ FlameProtocol::RequestRoute (uint32_t sourceIface, const Mac48Address source, co
         {
           m_stats.txUnicast++;
         }
-      NS_LOG_DEBUG ("Source: send packet with RA = " << tag.receiver);
+      NS_LOG_DEBUG ("Source: send packet with RA = " << tag->receiver);
       packet->AddPacketTag (tag);
       routeReply (true, packet, source, destination, FLAME_PROTOCOL, result.ifIndex);
     }
@@ -191,17 +191,18 @@ FlameProtocol::RequestRoute (uint32_t sourceIface, const Mac48Address source, co
     {
       FlameHeader flameHdr;
       packet->RemoveHeader (flameHdr);
-      FlameTag tag;
 
-      if (!packet->RemovePacketTag (tag))
+      Ptr<const FlameTag> origTag = packet->RemovePacketTag<FlameTag> ();
+      if (origTag == 0)
         {
           NS_FATAL_ERROR ("FLAME tag must exist here");
         }
+      
       if (destination == Mac48Address::GetBroadcast ())
         {
           //Broadcast always is forwarded as broadcast!
-          NS_ASSERT (HandleDataFrame (flameHdr.GetSeqno (), source, flameHdr, tag.transmitter, sourceIface));
-          FlameTag tag (Mac48Address::GetBroadcast ());
+          NS_ASSERT (HandleDataFrame (flameHdr.GetSeqno (), source, flameHdr, origTag->transmitter, sourceIface));
+          Ptr<FlameTag> tag = CreateObject<FlameTag> (Mac48Address::GetBroadcast ());
           flameHdr.AddCost (1);
           m_stats.txBytes += packet->GetSize ();
           packet->AddHeader (flameHdr);
@@ -212,27 +213,28 @@ FlameProtocol::RequestRoute (uint32_t sourceIface, const Mac48Address source, co
         }
       else
         {
+          Ptr<FlameTag> tag = CreateObject<FlameTag> (*origTag);
           // We check sequence only when forward unicast, because broadcast-checks were done
           // inside remove routing stuff.
-          if (HandleDataFrame (flameHdr.GetSeqno (), source, flameHdr, tag.transmitter, sourceIface))
+          if (HandleDataFrame (flameHdr.GetSeqno (), source, flameHdr, tag->transmitter, sourceIface))
             {
               return false;
             }
           FlameRtable::LookupResult result = m_rtable->Lookup (destination);
-          if (tag.receiver != Mac48Address::GetBroadcast ())
+          if (origTag->receiver != Mac48Address::GetBroadcast ())
             {
               if (result.retransmitter == Mac48Address::GetBroadcast ())
                 {
                   NS_LOG_DEBUG ("unicast packet dropped, because no route! I am " << GetAddress ()
-                                                                                  << ", RA = " << tag.receiver << ", TA = " << tag.transmitter);
+                                                                                  << ", RA = " << origTag->receiver << ", TA = " << origTag->transmitter);
                   m_stats.totalDropped++;
                   return false;
                 }
-              tag.receiver = result.retransmitter;
+              tag->receiver = result.retransmitter;
             }
           else
             {
-              tag.receiver = Mac48Address::GetBroadcast ();
+              tag->receiver = Mac48Address::GetBroadcast ();
             }
           if (result.retransmitter == Mac48Address::GetBroadcast ())
             {
@@ -263,14 +265,14 @@ FlameProtocol::RemoveRoutingStuff (uint32_t fromIface, const Mac48Address source
       NS_LOG_DEBUG ("Dropped my own frame!");
       return false;
     }
-  FlameTag tag;
-  if (!packet->RemovePacketTag (tag))
+  Ptr<const FlameTag> tag = packet->RemovePacketTag <FlameTag> ();
+  if (tag == 0)
     {
       NS_FATAL_ERROR ("FLAME tag must exist when packet is coming to protocol");
     }
   FlameHeader flameHdr;
   packet->RemoveHeader (flameHdr);
-  if (HandleDataFrame (flameHdr.GetSeqno (), source, flameHdr, tag.transmitter, fromIface))
+  if (HandleDataFrame (flameHdr.GetSeqno (), source, flameHdr, tag->transmitter, fromIface))
     {
       return false;
     }
--- a/src/mesh/model/mesh-wifi-interface-mac.cc	
+++ a/src/mesh/model/mesh-wifi-interface-mac.cc	
@@ -222,15 +222,15 @@ MeshWifiInterfaceMac::ForwardDown (Ptr<const Packet> const_packet, Mac48Address
   //Classify: application sets a tag, which is removed here
   // Get Qos tag:
   AcIndex ac = AC_BE;
-  QosTag tag;
-  if (packet->RemovePacketTag (tag))
+  Ptr<const QosTag> tag = packet->RemovePacketTag<QosTag> ();
+  if (tag != 0)
     {
       hdr.SetType (WIFI_MAC_QOSDATA);
-      hdr.SetQosTid (tag.GetTid ());
+      hdr.SetQosTid (tag->GetTid ());
       //Aftre setting type DsFrom and DsTo fields are reset.
       hdr.SetDsFrom ();
       hdr.SetDsTo ();
-      ac = QosUtilsMapTidToAc (tag.GetTid ());
+      ac = QosUtilsMapTidToAc (tag->GetTid ());
     }
   m_stats.sentFrames++;
   m_stats.sentBytes += packet->GetSize ();
@@ -446,7 +446,7 @@ MeshWifiInterfaceMac::Receive (Ptr<Packet> packet, WifiMacHeader const *hdr)
   // Check if QoS tag exists and add it:
   if (hdr->IsQosData ())
     {
-      packet->AddPacketTag (QosTag (hdr->GetQosTid ()));
+      packet->AddPacketTag (CreateObject<QosTag> (hdr->GetQosTid ()));
     }
   // Forward data up
   if (hdr->IsData ())
--- a/src/network/examples/main-packet-tag.cc	
+++ a/src/network/examples/main-packet-tag.cc	
@@ -96,8 +96,8 @@ MyTag::GetSimpleValue (void) const
 int main (int argc, char *argv[])
 {
   // create a tag.
-  MyTag tag;
-  tag.SetSimpleValue (0x56);
+  Ptr<MyTag> tag = CreateObject<MyTag> ();
+  tag->SetSimpleValue (0x56);
 
   // store the tag in a packet.
   Ptr<Packet> p = Create<Packet> (100);
@@ -107,11 +107,10 @@ int main (int argc, char *argv[])
   Ptr<Packet> aCopy = p->Copy ();
 
   // read the tag from the packet copy
-  MyTag tagCopy;
-  p->PeekPacketTag (tagCopy);
+  Ptr<const MyTag> tagCopy = p->PeekPacketTag<MyTag> ();
 
   // the copy and the original are the same !
-  NS_ASSERT (tagCopy.GetSimpleValue () == tag.GetSimpleValue ());
+  NS_ASSERT (tagCopy->GetSimpleValue () == tag->GetSimpleValue ());
 
   aCopy->PrintPacketTags (std::cout);
   std::cout << std::endl;
--- a/src/network/utils/packet-socket.cc	
+++ a/src/network/utils/packet-socket.cc	
@@ -385,13 +385,13 @@ PacketSocket::ForwardUp (Ptr<NetDevice> device, Ptr<const Packet> packet,
   if ((m_rxAvailable + packet->GetSize ()) <= m_rcvBufSize)
     {
       Ptr<Packet> copy = packet->Copy ();
-      DeviceNameTag dnt;
-      dnt.SetDeviceName (device->GetTypeId ().GetName ());
-      PacketSocketTag pst;
-      pst.SetPacketType (packetType);
-      pst.SetDestAddress (to);
-      SocketAddressTag tag;
-      tag.SetAddress (address);
+      Ptr<DeviceNameTag> dnt = CreateObject<DeviceNameTag> ();
+      dnt->SetDeviceName (device->GetTypeId ().GetName ());
+      Ptr<PacketSocketTag> pst = CreateObject<PacketSocketTag> ();
+      pst->SetPacketType (packetType);
+      pst->SetDestAddress (to);
+      Ptr<SocketAddressTag> tag = CreateObject<SocketAddressTag> ();
+      tag->SetAddress (address);
       copy->AddPacketTag (tag); // Attach From Physical Address
       copy->AddPacketTag (pst); // Attach Packet Type and Dest Address
       copy->AddPacketTag (dnt); // Attach device source name
@@ -449,11 +449,9 @@ PacketSocket::RecvFrom (uint32_t maxSize, uint32_t flags, Address &fromAddress)
   Ptr<Packet> packet = Recv (maxSize, flags);
   if (packet != 0)
     {
-      SocketAddressTag tag;
-      bool found;
-      found = packet->PeekPacketTag (tag);
-      NS_ASSERT (found);
-      fromAddress = tag.GetAddress ();
+      Ptr<const SocketAddressTag> tag = packet->PeekPacketTag<SocketAddressTag> ();
+      NS_ASSERT (tag != 0);
+      fromAddress = tag->GetAddress ();
     }
   return packet;
 }
@@ -611,7 +609,7 @@ uint32_t
 DeviceNameTag::GetSerializedSize (void) const
 {
   uint32_t s = 1 + m_deviceName.size();
-  return ( s >= PACKET_TAG_MAX_SIZE)?PACKET_TAG_MAX_SIZE:s;
+  return s;
 }
 void
 DeviceNameTag::Serialize (TagBuffer i) const
@@ -619,8 +617,6 @@ DeviceNameTag::Serialize (TagBuffer i) const
   const char *n = m_deviceName.c_str();
   uint8_t l = (uint8_t) strlen (n);
 
-  if ( ( 1 + l ) > PACKET_TAG_MAX_SIZE ) l = PACKET_TAG_MAX_SIZE - 1;
-
   i.WriteU8 (l);
   i.Write ( (uint8_t*) n , (uint32_t) l );
 }
--- a/src/virtual-net-device/examples/virtual-net-device.cc	
+++ a/src/virtual-net-device/examples/virtual-net-device.cc	
@@ -113,8 +113,7 @@ class Tunnel
   {
     Ptr<Packet> packet = socket->Recv (65535, 0);
     NS_LOG_DEBUG ("N3SocketRecv: " << *packet);
-    SocketAddressTag socketAddressTag;
-    packet->RemovePacketTag (socketAddressTag);
+    packet->RemovePacketTag<SocketAddressTag> ();
     m_n3Tap->Receive (packet, 0x0800, m_n3Tap->GetAddress (), m_n3Tap->GetAddress (), NetDevice::PACKET_HOST);
   }
 
@@ -122,8 +121,7 @@ class Tunnel
   {
     Ptr<Packet> packet = socket->Recv (65535, 0);
     NS_LOG_DEBUG ("N0SocketRecv: " << *packet);
-    SocketAddressTag socketAddressTag;
-    packet->RemovePacketTag (socketAddressTag);
+    packet->RemovePacketTag<SocketAddressTag> ();
     m_n0Tap->Receive (packet, 0x0800, m_n0Tap->GetAddress (), m_n0Tap->GetAddress (), NetDevice::PACKET_HOST);
   }
 
@@ -131,8 +129,7 @@ class Tunnel
   {
     Ptr<Packet> packet = socket->Recv (65535, 0);
     NS_LOG_DEBUG ("N1SocketRecv: " << *packet);
-    SocketAddressTag socketAddressTag;
-    packet->RemovePacketTag (socketAddressTag);
+    packet->RemovePacketTag<SocketAddressTag> ();
     m_n1Tap->Receive (packet, 0x0800, m_n1Tap->GetAddress (), m_n1Tap->GetAddress (), NetDevice::PACKET_HOST);
   }
 
--- a/src/wifi/model/mac-low.cc	
+++ a/src/wifi/model/mac-low.cc	
@@ -709,12 +709,11 @@ MacLow::ReceiveOk (Ptr<Packet> packet, double rxSnr, WifiMode txMode, WifiPreamb
            && m_currentPacket != 0)
     {
       NS_LOG_DEBUG ("receive cts from=" << m_currentHdr.GetAddr1 ());
-      SnrTag tag;
-      packet->RemovePacketTag (tag);
+      Ptr<const SnrTag> tag = packet->RemovePacketTag<SnrTag> ();
       m_stationManager->ReportRxOk (m_currentHdr.GetAddr1 (), &m_currentHdr,
                                     rxSnr, txMode);
       m_stationManager->ReportRtsOk (m_currentHdr.GetAddr1 (), &m_currentHdr,
-                                     rxSnr, txMode, tag.Get ());
+                                     rxSnr, txMode, tag->Get ());
 
       m_ctsTimeoutEvent.Cancel ();
       NotifyCtsTimeoutResetNow ();
@@ -734,12 +733,11 @@ MacLow::ReceiveOk (Ptr<Packet> packet, double rxSnr, WifiMode txMode, WifiPreamb
            && m_txParams.MustWaitAck ())
     {
       NS_LOG_DEBUG ("receive ack from=" << m_currentHdr.GetAddr1 ());
-      SnrTag tag;
-      packet->RemovePacketTag (tag);
+      Ptr<const SnrTag> tag = packet->RemovePacketTag<SnrTag> ();
       m_stationManager->ReportRxOk (m_currentHdr.GetAddr1 (), &m_currentHdr,
                                     rxSnr, txMode);
       m_stationManager->ReportDataOk (m_currentHdr.GetAddr1 (), &m_currentHdr,
-                                      rxSnr, txMode, tag.Get ());
+                                      rxSnr, txMode, tag->Get ());
       bool gotAck = false;
       if (m_txParams.MustWaitNormalAck ()
           && m_normalAckTimeoutEvent.IsRunning ())
@@ -1446,8 +1444,8 @@ MacLow::SendCtsAfterRts (Mac48Address source, Time duration, WifiMode rtsTxMode,
   WifiMacTrailer fcs;
   packet->AddTrailer (fcs);
 
-  SnrTag tag;
-  tag.Set (rtsSnr);
+  Ptr<SnrTag> tag = CreateObject<SnrTag> ();
+  tag->Set (rtsSnr);
   packet->AddPacketTag (tag);
 
   ForwardDown (packet, &cts, ctsTxMode);
@@ -1525,8 +1523,8 @@ MacLow::SendAckAfterData (Mac48Address source, Time duration, WifiMode dataTxMod
   WifiMacTrailer fcs;
   packet->AddTrailer (fcs);
 
-  SnrTag tag;
-  tag.Set (dataSnr);
+  Ptr<SnrTag> tag = CreateObject<SnrTag> ();
+  tag->Set (dataSnr);
   packet->AddPacketTag (tag);
 
   ForwardDown (packet, &ack, ackTxMode);
--- a/src/wifi/model/qos-utils.cc	
+++ a/src/wifi/model/qos-utils.cc	
@@ -59,13 +59,13 @@ QosUtilsMapTidToAc (uint8_t tid)
 uint8_t
 QosUtilsGetTidForPacket (Ptr<const Packet> packet)
 {
-  QosTag qos;
+  Ptr<const QosTag> qos = packet->PeekPacketTag<QosTag> ();
   uint8_t tid = 8;
-  if (packet->PeekPacketTag (qos))
+  if (qos != 0)
     {
-      if (qos.GetTid () < 8)
+      if (qos->GetTid () < 8)
         {
-          tid = qos.GetTid ();
+          tid = qos->GetTid ();
         }
     }
   return tid;
--- a/src/wifi/model/wifi-remote-station-manager.cc	
+++ a/src/wifi/model/wifi-remote-station-manager.cc	
@@ -347,12 +347,12 @@ WifiRemoteStationManager::PrepareForQueue (Mac48Address address, const WifiMacHe
   WifiRemoteStation *station = Lookup (address, header);
   WifiMode rts = DoGetRtsMode (station);
   WifiMode data = DoGetDataMode (station, fullPacketSize);
-  TxModeTag tag;
+  
   // first, make sure that the tag is not here anymore.
-  ConstCast<Packet> (packet)->RemovePacketTag (tag);
-  tag = TxModeTag (rts, data);
+  ConstCast<Packet> (packet)->RemovePacketTag<TxModeTag> ();
+  Ptr<TxModeTag> tag = CreateObject<TxModeTag> (rts, data);
   // and then, add it back
-  packet->AddPacketTag (tag);
+  ConstCast<Packet> (packet)->AddPacketTag (tag);
 }
 WifiMode
 WifiRemoteStationManager::GetDataMode (Mac48Address address, const WifiMacHeader *header,
@@ -364,11 +364,9 @@ WifiRemoteStationManager::GetDataMode (Mac48Address address, const WifiMacHeader
     }
   if (!IsLowLatency ())
     {
-      TxModeTag tag;
-      bool found;
-      found = ConstCast<Packet> (packet)->PeekPacketTag (tag);
-      NS_ASSERT (found);
-      return tag.GetDataMode ();
+      Ptr<const TxModeTag> tag = packet->PeekPacketTag<TxModeTag> ();
+      NS_ASSERT (tag != 0);
+      return tag->GetDataMode ();
     }
   return DoGetDataMode (Lookup (address, header), fullPacketSize);
 }
@@ -379,11 +377,9 @@ WifiRemoteStationManager::GetRtsMode (Mac48Address address, const WifiMacHeader
   NS_ASSERT (!address.IsGroup ());
   if (!IsLowLatency ())
     {
-      TxModeTag tag;
-      bool found;
-      found = ConstCast<Packet> (packet)->PeekPacketTag (tag);
-      NS_ASSERT (found);
-      return tag.GetRtsMode ();
+      Ptr<const TxModeTag> tag = packet->PeekPacketTag<TxModeTag> ();
+      NS_ASSERT (tag != 0);
+      return tag->GetRtsMode ();
     }
   return DoGetRtsMode (Lookup (address, header));
 }
--- a/utils/bench-packets.cc	
+++ a/utils/bench-packets.cc	
@@ -163,19 +163,19 @@ benchD (uint32_t n)
 {
   BenchHeader<25> ipv4;
   BenchHeader<8> udp;
-  BenchTag<16> tag1;
-  BenchTag<17> tag2;
 
   for (uint32_t i = 0; i < n; i++) {
     Ptr<Packet> p = Create<Packet> (2000);
-    p->AddPacketTag (tag1);
+    p->AddPacketTag (CreateObject<BenchTag<16> > ());
     p->AddHeader (udp);
-    p->RemovePacketTag (tag1);
-    p->AddPacketTag (tag2);
+    p->RemovePacketTag (BenchTag<16>::GetTypeId ());
+    
+    p->AddPacketTag (CreateObject<BenchTag<17> > ());
     p->AddHeader (ipv4);
+    
     Ptr<Packet> o = p->Copy ();
     o->RemoveHeader (ipv4);
-    p->RemovePacketTag (tag2);
+    p->RemovePacketTag (BenchTag<17>::GetTypeId ());
     o->RemoveHeader (udp);
   }
 }
--