Routing Protocol for Low-Power and Lossy Networks (RPL) is a standard routing protocol for the Low Power and Lossy Networks (LLNs). It is a part of the IPv6 over Low-Power Wireless Personal Area Network (6LoWPAN) protocol stack. Features such as energy-efficient mechanisms and availability of the secure modes of operations make RPL suitable for the constrained Internet of Things (IoT) devices. Hence, the majority of IoT applications rely on RPL for data communication. However, routing security in RPL-based IoT networks is a significant concern, motivating us to study and analyze routing attacks and suggested countermeasures against them. To this end, we provide a comprehensive survey on the state-of-the-art security threats and their corresponding countermeasures in RPL-based IoT networks. Based on our study, we propose a novel classification scheme that uses a mapping between RPL attacks and their countermeasure techniques to the RPL control messages used to develop these techniques. Furthermore, we provide an in-depth statistical analysis that includes analysis of routing attacks through the RPL control messages, distribution of various mitigation techniques as per the method used, RPL control messages involved in the mitigation techniques, and details of the tools used by multiple researchers. In the end, we highlight some open challenges and future research opportunities on this topic. We believe that this survey will be beneficial to researchers and practitioners working in the area of RPL security. [ABSTRACT FROM AUTHOR]