RFC 2004

Minimal Encapsulation within IP

📅 published October 1996, from ietf

RFC 2004: Minimal Encapsulation within IP ✨

Number: RFC 2004
Title: Minimal Encapsulation within IP
Author: C. Perkins, IBM
Category: Standards Track
Date: October 1996
Obsoletes / Updates: the header doesn't list anything this RFC obsoletes or updates 📜

Status of This Memo 📜

This doc is a Standards Track protocol spec for the Internet community, and it's asking for discussion and suggestions to make it better 🫶. If you want to know where this protocol stands in the standardization process, check the current "Internet Official Protocol Standards" (STD 1) 💅. Distribution of this memo is unlimited 🌸.

Abstract 🦋

Okay so this doc explains how to pop one IP datagram inside another IP datagram as its payload 🎁. It's way lighter than "conventional" IP encapsulation, which slaps a whole second IP header on every packet you wrap 💀. Encapsulation is basically a way to change how datagrams normally get routed. You deliver them to some middle destination that the network part of the IP Destination Address in the original header would never have picked on its own 🧚. Encapsulation can be used for lots of stuff, like getting a datagram to a mobile node that's using Mobile IP 🌈.

1. Introduction 🧚

This doc is about the same idea as above: wrapping an IP datagram inside another IP datagram, with way less overhead than "conventional" IP encapsulation [4], which adds a second IP header to every encapsulated datagram 🍓. Encapsulation changes normal routing by delivering datagrams to an intermediate destination the network part of the original Destination Address field would not have chosen 💜.

Wrapping and unwrapping a datagram is usually called "tunneling" 🚇. The encapsulator and decapsulator are the two "endpoints" of the tunnel 👑. The encapsulator node is the "entry point" of the tunnel, and the decapsulator node is the "exit point" ✨.

2. Motivation 💖

The Mobile IP working group came up with encapsulation as a way to get packets from a mobile node's "home network" to an agent that can deliver them locally, using normal methods, wherever the mobile node currently is 🌸 [5]. Encapsulation can also be used whenever the source of a datagram (or some router along the way) needs to influence which route the datagram takes to its final destination 🔥. Other uses include multicasting, preferential billing, picking routes with certain security attributes, and general policy routing 💅.

Take a look at [4] for a discussion of the advantages encapsulation has over the IP loose source routing option 🙈. Using IP headers to encapsulate IP datagrams duplicates several fields in the inner header for no reason, so this spec defines a new encapsulation method that gets rid of the duplication and saves some space 🎀. The scheme here came from the Mobile IP Working Group (in earlier Internet Drafts) and is similar to what was defined in [2] 🦋.

3. Minimal Encapsulation 🎀

A minimal forwarding header is defined for datagrams that were not fragmented before they got encapsulated 🧁. Using this encapsulation method is optional 🌈. Minimal encapsulation MUST NOT be used when the original datagram is already fragmented, because the minimal forwarding header has no room to store fragmentation info 💀. To encapsulate a datagram this way, you insert the minimal forwarding header into the datagram like this:

     +---------------------------+       +---------------------------+
     |                           |       |                           |
     |         IP Header         |       |     Modified IP Header    |
     |                           |       |                           |
     +---------------------------+ ====> +---------------------------+
     |                           |       | Minimal Forwarding Header |
     |                           |       +---------------------------+
     |         IP Payload        |       |                           |
     |                           |       |                           |
     |                           |       |         IP Payload        |
     +---------------------------+       |                           |
                                         |                           |
                                         +---------------------------+

The original IP header gets modified, and the minimal forwarding header goes in right after it 🧚. The IP payload stays exactly the same after that, like the transport header and transport data 🫶. No extra IP header gets added at all 🙌.

When you encapsulate, the original IP header [6] gets changed like this:

The Protocol field gets replaced with protocol number 55, which is the minimal encapsulation protocol 🔥.
The Destination Address field gets replaced with the IP address of the tunnel's exit point 🦋.
If the encapsulator isn't the original source of the datagram, the Source Address field gets replaced with the IP address of the encapsulator 💜.
The Total Length field goes up by the size of the minimal forwarding header. That's either 12 or 8 octets, depending on whether the Original Source Address Present (S) bit is set in the forwarding header 📏.
The Header Checksum field gets recomputed [6] or updated to account for all the header changes listed here 🧮.

Okay so here's the thing that's kinda iconic: unlike IP-in-IP encapsulation [4], the Time to Live (TTL) field is not modified during encapsulation 👑. If the encapsulator is forwarding the datagram, it'll decrement the TTL as part of normal IP forwarding 🌸. And since the original TTL stays in the IP header after encapsulation, hops the datagram takes inside the tunnel are visible to things like "traceroute" 🔍✨.

The minimal forwarding header looks like this:

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |   Protocol    |S|  reserved   |        Header Checksum        |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                 Original Destination Address                  |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   :            (if present) Original Source Address               :
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Here's what each field does 💖:

Protocol: copied from the Protocol field in the original IP header 🎀.
Original Source Address Present (S): the field tells you how long the header is 🧠.
- 0: the Original Source Address field is not present, and the minimal tunneling header is 8 octets long 🙈.
- 1: the Original Source Address field is present, and the minimal tunneling header is 12 octets long 💅.
reserved: sent as zero, and ignored when received 🌈.
Header Checksum: the 16-bit one's complement of the one's complement sum of all 16-bit words in the minimal forwarding header 🧮. To compute it, the checksum field's value is 0 🧁. The IP header and the IP payload after the minimal forwarding header are not included in this checksum 🫶.
Original Destination Address: copied from the Destination Address field in the original IP header 🦋.
Original Source Address: copied from the Source Address field in the original IP header 💜. This field only shows up if the Original Source Address Present (S) bit is set ✨.

When you decapsulate a datagram, the fields in the minimal forwarding header get restored into the IP header, and then the forwarding header gets removed from the datagram 🔄. The Total Length field in the IP header goes down by the size of the forwarding header you removed 📉. The Header Checksum field gets recomputed [6] or updated to account for the decapsulation changes to the IP header 🧮.

The encapsulator can use the existing IP mechanisms that make sense for delivering the encapsulated payload to the tunnel exit point 🚀. IP options are allowed 🎁. Fragmentation is allowed too, unless the "Don't Fragment" bit is set in the IP header 🙌. That fragmentation restriction is required so that nodes using Path MTU Discovery [3] can get the info they're looking for 🔍💖.

4. Routing Failures 💀

Using any encapsulation method for routing purposes makes routing loops way more likely 🌀. To cut down on that danger, a router should follow the same procedures outlined in [4] 🛡️.

5. ICMP Messages from within the Tunnel 💌

ICMP messages should be handled as specified in [4] 🫶. That includes maintaining the tunnel "soft state" 🧚.

6. Security Considerations 🔐

Security considerations are not addressed in this document 😭. They're generally similar to the ones outlined in [4] 💜. Don't assume this spec has you covered on security. Go read [4] before you ship anything 🚨.

7. Acknowledgements 🫶

The original text for much of Section 3 came from the Mobile IP draft [1] 📜. Huge thanks to David Johnson for improving consistency and making a bunch of other improvements to the draft 👑.

References 📚

[1] Perkins, C., Editor, "IPv4 Mobility Support", Work in Progress, May 1995.
[2] David B. Johnson. Scalable and Robust Internetwork Routing for Mobile Hosts. In Proceedings of the 14th International Conference on Distributed Computing Systems, pages 2--11, June 1994.
[3] Mogul, J., and S. Deering, "Path MTU Discovery", RFC 1191, November 1990.
[4] Perkins, C., "IP Encapsulation within IP", RFC 2003, October 1996.
[5] Perkins, C., Editor, "IP Mobility Support", RFC 2002, October 1996.
[6] Postel, J., Editor, "Internet Protocol", STD 5, RFC 791, September 1981.

Author's Address 💌

Questions about this memo can be sent to Charles Perkins 📬:

Charles Perkins
Room H3-D34
T. J. Watson Research Center
IBM Corporation
30 Saw Mill River Rd.
Hawthorne, NY  10532

Work:   +1-914-784-7350
Fax:    +1-914-784-6205
EMail: perk@watson.ibm.com

The working group can be reached through the current chair 🎀:

Jim Solomon
Motorola, Inc.
1301 E. Algonquin Rd.
Schaumburg, IL  60196

Work:   +1-847-576-2753
EMail: solomon@comm.mot.com

📦 where this page comes from

ietf: rfc2004 1996-10
💖 girlified by claude-haiku-5-5 on 2026-10-15: a language model's rewrite of the original, under its terms