RFC 2960
Stream Control Transmission Protocol
RFC 2960: Stream Control Transmission Protocol 🦋
Part 1 of 28, bestie, more coming! 🧚
Okay so this is RFC 2960 📜, and its title is "Stream Control Transmission Protocol." It's on the Standards Track, which means it's a real spec for the Internet ✨ It was published in October 2000 🍓. The authors are R. Stewart and Q. Xie (Motorola), K. Morneault and C. Sharp (Cisco), H. Schwarzbauer (Siemens), T. Taylor (Nortel Networks), I. Rytina (Ericsson), M. Kalla (Telcordia), L. Zhang (UCLA), and V. Paxson (ACIRI) 👑. The title block doesn't list anything it obsoletes or updates.
Status of This Memo ✨
This doc is an Internet standards track protocol spec for the Internet community, and it's literally asking for discussion and suggestions to make it better 🫶 If you want to know where this protocol stands in standardization, check the current edition of "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited, so share away 💜
Copyright Notice 🌈
The legal bit, verbatim:
Copyright (C) The Internet Society (2000). All Rights Reserved.
Abstract 💖
Okay, the main event! 🔥 This doc describes the Stream Control Transmission Protocol, or SCTP for short. SCTP was designed to carry PSTN signaling messages over IP networks, but it's giving "capable of so much more" 💅
SCTP is a reliable transport protocol that runs on top of a connectionless packet network like IP. It offers these services to its users:
- acknowledged error-free non-duplicated transfer of user data 🦋
- data fragmentation to conform to discovered path MTU size 🧚
- sequenced delivery of user messages within multiple streams, with an option for order-of-arrival delivery of individual user messages ✨
- optional bundling of multiple user messages into a single SCTP packet 🎀
- network-level fault tolerance through supporting multi-homing at either or both ends of an association 👑
The design of SCTP includes appropriate congestion avoidance behavior and resistance to flooding and masquerade attacks. Iconic behavior, honestly 😭🫶
Table of Contents 🧚
1. Introduction.................................................. 5
1.1 Motivation.................................................. 6
1.2 Architectural View of SCTP.................................. 6
1.3 Functional View of SCTP..................................... 7
1.3.1 Association Startup and Takedown........................ 8
1.3.2 Sequenced Delivery within Streams....................... 9
1.3.3 User Data Fragmentation................................. 9
1.3.4 Acknowledgement and Congestion Avoidance................ 9
1.3.5 Chunk Bundling ......................................... 10
1.3.6 Packet Validation....................................... 10
1.3.7 Path Management......................................... 11
1.4 Key Terms................................................... 11
1.5 Abbreviations............................................... 15
1.6 Serial Number Arithmetic.................................... 15
2. Conventions.................................................... 16
3. SCTP packet Format............................................ 16
3.1 SCTP Common Header Field Descriptions....................... 17
3.2 Chunk Field Descriptions.................................... 18
3.2.1 Optional/Variable-length Parameter Format............... 20
3.3 SCTP Chunk Definitions...................................... 21
3.3.1 Payload Data (DATA)..................................... 22
3.3.2 Initiation (INIT)....................................... 24
3.3.2.1 Optional or Variable Length Parameters.............. 26
3.3.3 Initiation Acknowledgement (INIT ACK)................... 30
3.3.3.1 Optional or Variable Length Parameters.............. 33
3.3.4 Selective Acknowledgement (SACK)........................ 33
3.3.5 Heartbeat Request (HEARTBEAT)........................... 37
3.3.6 Heartbeat Acknowledgement (HEARTBEAT ACK)............... 38
3.3.7 Abort Association (ABORT)............................... 39
3.3.8 Shutdown Association (SHUTDOWN)......................... 40
3.3.9 Shutdown Acknowledgement (SHUTDOWN ACK)................. 40
3.3.10 Operation Error (ERROR)................................ 41
3.3.10.1 Invalid Stream Identifier.......................... 42
3.3.10.2 Missing Mandatory Parameter........................ 43
3.3.10.3 Stale Cookie Error................................. 43
3.3.10.4 Out of Resource.................................... 44
3.3.10.5 Unresolvable Address............................... 44
3.3.10.6 Unrecognized Chunk Type............................ 44
3.3.10.7 Invalid Mandatory Parameter........................ 45
3.3.10.8 Unrecognized Parameters............................ 45
3.3.10.9 No User Data....................................... 46
3.3.10.10 Cookie Received While Shutting Down............... 46
3.3.11 Cookie Echo (COOKIE ECHO).............................. 46
3.3.12 Cookie Acknowledgement (COOKIE ACK).................... 47
3.3.13 Shutdown Complete (SHUTDOWN COMPLETE).................. 48
4. SCTP Association State Diagram................................. 48
5. Association Initialization..................................... 52
5.1 Normal Establishment of an Association...................... 52
5.1.1 Handle Stream Parameters................................ 54
5.1.2 Handle Address Parameters............................... 54
5.1.3 Generating State Cookie................................. 56
5.1.4 State Cookie Processing................................. 57
5.1.5 State Cookie Authentication............................. 57
5.1.6 An Example of Normal Association Establishment.......... 58
5.2 Handle Duplicate or unexpected INIT, INIT ACK, COOKIE ECHO,
and COOKIE ACK.............................................. 60
5.2.1 Handle Duplicate INIT in COOKIE-WAIT
or COOKIE-ECHOED States................................. 60
5.2.2 Unexpected INIT in States Other than CLOSED,
COOKIE-ECHOED, COOKIE-WAIT and SHUTDOWN-ACK-SENT........ 61
5.2.3 Unexpected INIT ACK..................................... 61
5.2.4 Handle a COOKIE ECHO when a TCB exists.................. 62
5.2.4.1 An Example of a Association Restart................. 64
5.2.5 Handle Duplicate COOKIE ACK............................. 66
5.2.6 Handle Stale COOKIE Error............................... 66
5.3 Other Initialization Issues................................. 67
5.3.1 Selection of Tag Value.................................. 67
6. User Data Transfer............................................. 67
6.1 Transmission of DATA Chunks................................. 69
6.2 Acknowledgement on Reception of DATA Chunks................. 70
6.2.1 Tracking Peer's Receive Buffer Space.................... 73
6.3 Management Retransmission Timer............................. 75
6.3.1 RTO Calculation......................................... 75
6.3.2 Retransmission Timer Rules.............................. 76
6.3.3 Handle T3-rtx Expiration................................ 77
6.4 Multi-homed SCTP Endpoints.................................. 78
6.4.1 Failover from Inactive Destination Address.............. 79
6.5 Stream Identifier and Stream Sequence Number................ 80
6.6 Ordered and Unordered Delivery.............................. 80
6.7 Report Gaps in Received DATA TSNs........................... 81
6.8 Adler-32 Checksum Calculation............................... 82
6.9 Fragmentation............................................... 83
6.10 Bundling .................................................. 84
7. Congestion Control .......................................... 85
7.1 SCTP Differences from TCP Congestion Control................ 85
7.2 SCTP Slow-Start and Congestion Avoidance.................... 87
7.2.1 Slow-Start.............................................. 87
7.2.2 Congestion Avoidance.................................... 89
7.2.3 Congestion Control...................................... 89
7.2.4 Fast Retransmit on Gap Reports.......................... 90
7.3 Path MTU Discovery.......................................... 91
8. Fault Management.............................................. 92
8.1 Endpoint Failure Detection.................................. 92
8.2 Path Failure Detection...................................... 92
8.3 Path Heartbeat.............................................. 93
8.4 Handle "Out of the blue" Packets............................ 95
8.5 Verification Tag............................................ 96
8.5.1 Exceptions in Verification Tag Rules.................... 97
9. Termination of Association..................................... 98
9.1 Abort of an Association..................................... 98
9.2 Shutdown of an Association.................................. 98
10. Interface with Upper Layer....................................101
10.1 ULP-to-SCTP................................................101
10.2 SCTP-to-ULP................................................111
11. Security Considerations.......................................114
11.1 Security Objectives........................................114
11.2 SCTP Responses To Potential Threats........................115
11.2.1 Countering Insider Attacks.............................115
11.2.2 Protecting against Data Corruption in the Network......115
11.2.3 Protecting Confidentiality.............................115
11.2.4 Protecting against Blind Denial of Service Attacks.....116
11.2.4.1 Flooding...........................................116
11.2.4.2 Blind Masquerade...................................118
11.2.4.3 Improper Monopolization of Services................118
11.3 Protection against Fraud and Repudiation...................119
12. Recommended Transmission Control Block (TCB) Parameters.......120
12.1 Parameters necessary for the SCTP instance.................120
12.2 Parameters necessary per association (i.e. the TCB)........120
12.3 Per Transport Address Data.................................122
12.4 General Parameters Needed..................................123
13. IANA Considerations...........................................123
13.1 IETF-defined Chunk Extension...............................123
13.2 IETF-defined Chunk Parameter Extension.....................124
13.3 IETF-defined Additional Error Causes.......................124
13.4 Payload Protocol Identifiers...............................125
14. Suggested SCTP Protocol Parameter Values......................125
15. Acknowledgements..............................................126
16. Authors' Addresses............................................126
17. References....................................................128
18. Bibliography..................................................129
Appendix A .......................................................131
Appendix B .......................................................132
Full Copyright Statement .........................................1341. Introduction ✨
okay so this section is where we get into why SCTP (the Stream Control Transmission Protocol) even exists 🫶 it's basically the intro that explains the reasoning behind building it, what services it offers, and the core concepts you need before the detailed protocol stuff makes sense. bestie, read this one first, it sets up literally everything else 💅
1.1 Motivation 🌸
okay so TCP [RFC793] has been the main way to do reliable data transfer on IP networks, and honestly it has been ICONIC for that 👑 but lowkey, more and more newer applications started finding TCP too limiting. so they just built their own reliable data transfer on top of UDP [RFC768] instead 😭 the stuff they wanted to get around in TCP was:
- TCP gives you reliable data transfer AND strict order-of-transmission delivery, all bundled together. some apps only need reliability without the sequence stuff, and others would be happy with partial ordering. in both cases, the head-of-line blocking TCP does just causes unnecessary delay 🙈
- TCP is stream-oriented, and that is kind of a pain 💀 apps have to add their own record marking to mark where each message starts and ends, and they have to explicitly use the push facility so a complete message actually gets sent in a reasonable amount of time.
- TCP sockets have a limited scope, which makes it harder to get highly-available data transfer using multi-homed hosts 🍓
- TCP is pretty vulnerable to denial of service attacks, like SYN attacks 😬
so like, transporting PSTN signaling across the IP network is an application where ALL of these TCP limitations matter 🎀 that application is literally what directly motivated SCTP ✨ but other applications might find SCTP a really good match for their requirements too 🦋
1.2 Architectural View of SCTP
okay so SCTP sits as a layer between the SCTP user application (the "SCTP user" for short 💅) and a connectionless packet network service like IP. this doc assumes SCTP runs on top of IP 🌐. the basic service is reliable transfer of user messages between peer SCTP users, and it does that inside an association between two SCTP endpoints. Section 10 sketches the API that should exist at the boundary between the SCTP and SCTP user layers ✨.
SCTP is connection-oriented, but an SCTP association is a broader concept than a TCP connection 🦋. during association startup, SCTP lets each SCTP endpoint (Section 1.4) hand the other endpoint a list of transport addresses (multiple IP addresses paired with an SCTP port) where it can be reached and where it will send SCTP packets from 🫶. the association covers transfers over all the possible source/destination combos those two lists can make.
_____________ _____________
| SCTP User | | SCTP User |
| Application | | Application |
|-------------| |-------------|
| SCTP | | SCTP |
| Transport | | Transport |
| Service | | Service |
|-------------| |-------------|
| |One or more ---- One or more| |
| IP Network |IP address \/ IP address| IP Network |
| Service |appearances /\ appearances| Service |
|_____________| ---- |_____________|
SCTP Node A |<-------- Network transport ------->| SCTP Node B
Figure 1: An SCTP Association1.3 Functional View of SCTP
the SCTP transport service breaks down into a bunch of functions 🧩. they're shown in Figure 2 and explained in the rest of this section, so let's gooo 🚀.
SCTP User Application
-----------------------------------------------------
_____________ ____________________
| | | Sequenced delivery |
| Association | | within streams |
| | |____________________|
| startup |
| | ____________________________
| and | | User Data Fragmentation |
| | |____________________________|
| takedown |
| | ____________________________
| | | Acknowledgement |
| | | and |
| | | Congestion Avoidance |
| | |____________________________|
| |
| | ____________________________
| | | Chunk Bundling |
| | |____________________________|
| |
| | ________________________________
| | | Packet Validation |
| | |________________________________|
| |
| | ________________________________
| | | Path Management |
|_____________| |________________________________|
Figure 2: Functional View of the SCTP Transport Service1.3.1 Association Startup and Takedown
an association gets kicked off by a request from the SCTP user (check out the ASSOCIATE (or SEND) primitive in Section 10 🎀).
a cookie mechanism, kinda like the one Karn and Simpson describe in [RFC2522], shows up during initialization to protect against security attacks 🔐. it uses a four-way handshake, and the last two legs are allowed to carry user data for a fast setup ⚡. the startup sequence lives in Section 5 of this document.
SCTP gives you a graceful close (aka shutdown) of an active association whenever the SCTP user asks for it, see the SHUTDOWN primitive in Section 10 👋. it also allows an ungraceful close (aka abort), either when the user asks (ABORT primitive) or when an error gets detected inside the SCTP layer 💀. Section 9 covers both the graceful and ungraceful close procedures.
SCTP does not do a half-open state (unlike TCP) where one side keeps sending data while the other end is closed 🙅♀️. when either endpoint shuts down, the association on each peer stops accepting new data from its user and only delivers whatever was already queued at the time of the graceful close (see Section 9).
1.3.2 Sequenced Delivery within Streams
"stream" means something specific in SCTP 🌊. it refers to a sequence of user messages that have to be delivered to the upper-layer protocol in order, relative to other messages in that same stream. in TCP it means a sequence of bytes instead (and in this doc a byte is eight bits, just FYI 🤓).
at association startup, the SCTP user can choose how many streams the association supports. that number gets negotiated with the remote end (see Section 5.1.1). user messages are tied to stream numbers (SEND and RECEIVE primitives, Section 10 💌). internally, SCTP assigns a stream sequence number to each message the SCTP user hands over. on the receiving side, SCTP makes sure messages reach the SCTP user in sequence within a given stream. but if one stream is stuck waiting for the next in-sequence message, the other streams can keep on delivering 🏃♀️.
SCTP also has a way to skip the sequenced delivery service entirely. user messages sent that way get delivered to the SCTP user the second they arrive ⚡.
1.3.3 User Data Fragmentation
when it's needed, SCTP fragments user messages so the SCTP packet passed to the lower layer fits the path MTU 📏. on the way in, the fragments get reassembled into complete messages before they're handed to the SCTP user 🧩.
1.3.4 Acknowledgement and Congestion Avoidance
SCTP gives each user data fragment (or unfragmented message) a Transmission Sequence Number (TSN) 🔢. the TSN is totally independent of any stream sequence number assigned at the stream level, no cap 🙅♀️. the receiving end acknowledges every TSN it gets, even if there are gaps in the sequence. this is how reliable delivery stays functionally separate from sequenced stream delivery 💖.
the acknowledgement and congestion avoidance function handles packet retransmission when a timely acknowledgement hasn't arrived 🔁. the retransmission is governed by congestion avoidance procedures that are similar to the ones TCP uses. for the full protocol procedures tied to this function, see Sections 6 and 7 📚.
1.3.5 Chunk Bundling
as Section 3 describes, the SCTP packet that gets delivered to the lower layer is a common header followed by one or more chunks 📦. each chunk can carry either user data or SCTP control information. the SCTP user has the option to ask for more than one user message to be bundled into a single SCTP packet 🎁. the chunk bundling function is in charge of assembling the complete SCTP packet and then taking it apart again at the receiving end 🧸.
during congestion, an SCTP implementation MAY still bundle even if the user asked SCTP not to bundle, so that's a whole plot twist 😭.
the user's disabling of bundling only affects SCTP implementations that might wait a small bit before transmitting (to try to encourage bundling) ⏳. when the user layer disables bundling, that small delay is prohibited, but bundling that happens during congestion or retransmission is not.
1.3.6 Packet Validation
the SCTP common header includes a mandatory Verification Tag field and a 32 bit checksum field (see Appendix B for a description of the Adler-32 checksum) 🛡️. each end of the association picks the Verification Tag value during association startup. packets that show up without the expected Verification Tag value get discarded, which protects against blind masquerade attacks and against stale SCTP packets from a previous association 🚫. the Adler-32 checksum should be set by the sender of each SCTP packet, for extra protection against data corruption in the network 🧼. the receiver of an SCTP packet with an invalid Adler-32 checksum silently discards that packet 🤫.
1.3.7 Path Management
the sending SCTP user can manipulate the set of transport addresses used as destinations for SCTP packets, using the primitives described in Section 10 🗺️. the SCTP path management function picks the destination transport address for each outgoing SCTP packet, based on the SCTP user's instructions and the currently perceived reachability status of the eligible destination set 🎯. it monitors reachability through heartbeats when other packet traffic isn't giving enough info, and it tells the SCTP user whenever reachability of any far-end transport address changes 💓. path management is also in charge of reporting the eligible set of local transport addresses to the far end during association startup, and of reporting the transport addresses returned from the far end to the SCTP user 📬.
at association start-up, a primary path gets defined for each SCTP endpoint, and that's the path used for normal sending of SCTP packets 🛤️.
on the receiving end, path management checks that a valid SCTP association exists for the inbound SCTP packet before passing it along for further processing 🕵️♀️.
Note: Path Management and Packet Validation are done at the same time, so although they're described separately above, in reality they cannot be performed as separate items 🫠✨.
1.4 Key Terms 💅
okay so, some of the language we've been using to describe SCTP already showed up in the earlier sections, so this part pulls all the key terms into one list 📝 bookmark this one bestie 🔖
- Active destination transport address: a transport address on a peer endpoint that the transmitting endpoint thinks is available for receiving user messages 💖
- Bundling: an optional multiplexing thing where more than one user message can ride in the same SCTP packet. Each user message still gets its own DATA chunk 📦
- Chunk: a unit of info inside an SCTP packet, made of a chunk header plus chunk-specific content 🧩
- Congestion Window (cwnd): an SCTP variable that caps how many bytes a sender can send to a particular destination transport address before it gets an acknowledgement 🌊
- Cumulative TSN Ack Point: the TSN of the last DATA chunk acknowledged through the Cumulative TSN Ack field of a SACK ✨
- Idle destination address: an address that hasn't had user messages sent to it for a while, normally the HEARTBEAT interval or longer 💤
- Inactive destination transport address: an address that's considered inactive because of errors, so it's not available for carrying user messages 🚫
- Message = user message: data submitted to SCTP by the Upper Layer Protocol (ULP) 💌
- Message Authentication Code (MAC): an integrity check mechanism built on cryptographic hash functions that uses a secret key. Usually, MACs get used between two parties that share a secret key so they can validate info sent between them 🔐. In SCTP, an endpoint uses it to validate the State Cookie info that comes back from the peer in the COOKIE ECHO chunk. "MAC" means different things in different contexts, but SCTP uses it with the same meaning as in [RFC2104] 🎀
- Network Byte Order: most significant byte first, a.k.a. Big Endian 🍓
- Ordered Message: a user message that's delivered in order with respect to all previous user messages sent on the same stream it was sent on 📚
- Outstanding TSN (at an SCTP endpoint): a TSN (and its associated DATA chunk) that the endpoint has sent but hasn't received an acknowledgement for yet ⏳
- Path: the route taken by SCTP packets that one endpoint sends to a specific destination transport address of its peer. Sending to different destination transport addresses doesn't automatically mean you get separate paths 🛤️
- Primary Path: the destination and source address that gets put into a packet going out to the peer by default. The source address is included because an implementation MAY wish to specify both the destination and source address, so it can better control the return path taken by reply chunks and which interface the packet goes out on when the data sender is multi-homed 🏠
- Receiver Window (rwnd): an SCTP variable a data sender uses to store the most recently calculated receiver window of its peer, in number of bytes. It tells the sender how much space is left in the receiver's inbound buffer 🪟
- SCTP association: a protocol relationship between SCTP endpoints. It's made of the two endpoints plus protocol state info, including Verification Tags and the currently active set of Transmission Sequence Numbers (TSNs), etc. An association can be uniquely identified by the transport addresses the endpoints use. Two SCTP endpoints MUST NOT have more than one SCTP association between them at any given time 🚫👯
- SCTP endpoint: the logical sender/receiver of SCTP packets. On a multi-homed host, an SCTP endpoint looks to its peers like a combo of a set of eligible destination transport addresses that SCTP packets can be sent to and a set of eligible source transport addresses that SCTP packets can be received from. All transport addresses an SCTP endpoint uses must use the same port number, but they can use multiple IP addresses. A transport address used by an SCTP endpoint must not be used by another SCTP endpoint. Basically, a transport address is unique to one SCTP endpoint 🎯
- SCTP packet (or packet): the unit of data delivery across the interface between SCTP and the connectionless packet network (e.g., IP). An SCTP packet includes the common SCTP header, possible SCTP control chunks, and user data wrapped up in SCTP DATA chunks 📬
- SCTP user application (SCTP user): the logical higher-layer application entity that uses SCTP's services. It's also called the Upper-layer Protocol (ULP) 👑
- Slow Start Threshold (ssthresh): an SCTP variable. It's the threshold the endpoint uses to decide whether to do slow start or congestion avoidance on a particular destination transport address. ssthresh is in number of bytes 📈
- Stream: a uni-directional logical channel established from one associated SCTP endpoint to another. All user messages within it are delivered in sequence, except for the ones submitted to the unordered delivery service 🌈
Note: the relationship between stream numbers in opposite directions is strictly a matter of how the applications use them. It's the SCTP user's job to create and manage these correlations if they want them 🙈
- Stream Sequence Number: a 16-bit sequence number SCTP uses internally to make sure user messages get delivered in sequence within a given stream. One stream sequence number gets attached to each user message 🔢
- Tie-Tags: Verification Tags from a previous association. These Tags get used inside a State Cookie so the newly restarting association can be linked back to the original association within the endpoint that didn't restart 🧚
- Transmission Control Block (TCB): an internal data structure an SCTP endpoint creates for each of its existing SCTP associations with other SCTP endpoints. The TCB holds all the status and operational info the endpoint needs to maintain and manage that association 🗂️
- Transmission Sequence Number (TSN): a 32-bit sequence number SCTP uses internally. One TSN is attached to each chunk that contains user data, so the receiving endpoint can acknowledge it and detect duplicate deliveries 🔁
- Transport address: a transport address is traditionally defined by a Network Layer address, a Transport Layer protocol, and a Transport Layer port number. When SCTP runs over IP, a transport address is the combo of an IP address and an SCTP port number (where SCTP is the Transport protocol) 📍
- Unacknowledged TSN (at an SCTP endpoint): a TSN (and its associated DATA chunk) that the endpoint has received but hasn't sent an acknowledgement for yet. Or in the opposite case, it's for a packet that's been sent but no acknowledgement has come back for it 🫥
- Unordered Message: unordered messages are "unordered" with respect to any other message. That includes both other unordered messages and ordered messages. An unordered message might get delivered before or after ordered messages sent on the same stream 🌀
- User message: the unit of data delivery across the interface between SCTP and its user 💬
- Verification Tag: a randomly generated 32-bit unsigned integer. The Verification Tag is a key that lets a receiver check that an SCTP packet belongs to the current association and isn't an old or stale packet from a previous association 🔑
1.5. Abbreviations
Here are the abbreviations, all lined up nicely 💜
MAC - Message Authentication Code [RFC2104]
RTO - Retransmission Time-out
RTT - Round-trip Time
RTTVAR - Round-trip Time Variation
SCTP - Stream Control Transmission Protocol
SRTT - Smoothed RTT
TCB - Transmission Control Block
TLV - Type-Length-Value Coding Format
TSN - Transmission Sequence Number
ULP - Upper-layer Protocol1.6 Serial Number Arithmetic
Real talk, this part is so important 😭 The Transmission Sequence Number space is finite, even though it's super big. It runs from 0 to 2**32 - 1. Because the space is finite, all arithmetic on Transmission Sequence Numbers has to be done modulo 2**32. This unsigned arithmetic keeps the relationship between sequence numbers intact as they cycle from 2**32 - 1 back to 0 🔄 Computer modulo arithmetic has some subtleties, so be extra careful when you write comparisons for these values 👀 When we talk about TSNs, the symbol =< means "less than or equal" (modulo 2**32).
Comparisons and arithmetic on TSNs in this document SHOULD use Serial Number Arithmetic as defined in [RFC1982] where SERIAL_BITS = 32 🧮
An endpoint SHOULD NOT transmit a DATA chunk with a TSN that is more than 2**31 - 1 above the beginning TSN of its current send window. Doing that will cause problems when comparing TSNs 🙅♀️
Transmission Sequence Numbers wrap around when they reach 2**32 - 1. So the next TSN a DATA chunk MUST use after transmitting TSN = 2*32 - 1 is TSN = 0 🔁✨
Any arithmetic done on Stream Sequence Numbers SHOULD use Serial Number Arithmetic as defined in [RFC1982] where SERIAL_BITS = 16 🎀
All other arithmetic and comparisons in this document use normal arithmetic 🌸
2. Conventions
The keywords MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT, SHOULD, SHOULD NOT, RECOMMENDED, NOT RECOMMENDED, MAY, and OPTIONAL, when they appear in this document, are to be interpreted as described in [RFC2119] 📖💅
3. SCTP packet Format
An SCTP packet is made of a common header and chunks. A chunk holds either control information or user data 🧸
The SCTP packet format looks like this:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Common Header |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Chunk #1 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Chunk #n |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Multiple chunks can be bundled into one SCTP packet, as long as it fits within the MTU size. The exception is the INIT, INIT ACK, and SHUTDOWN COMPLETE chunks. These chunks MUST NOT be bundled with any other chunk in a packet. Check out Section 6.10 for more details on chunk bundling 🧺
If a user data message doesn't fit into one SCTP packet, it can be fragmented into multiple chunks using the procedure defined in Section 6.9 ✂️
All integer fields in an SCTP packet MUST be transmitted in network byte order, unless otherwise stated 🔢💖
3.1. SCTP Common Header Field Descriptions 💖
okay so the common header is the very first thing on every SCTP packet, and it's giving "here's who sent me and who I'm for" 🎀 ✨
SCTP Common Header Format
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Source Port Number | Destination Port Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Verification Tag |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Checksum |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Source Port Number: 16 bits (unsigned integer) 🦋
This is the SCTP sender's port number. The receiver can use it together with the source IP address, the SCTP destination port and possibly the destination IP address to figure out which association this packet belongs to. Main character energy, very identifying 👑
Destination Port Number: 16 bits (unsigned integer) 🌸
This is the SCTP port number the packet is destined for. The receiving host uses this port number to de-multiplex the SCTP packet to the correct receiving endpoint/application, so it always knows where the packet is actually going 💅
Verification Tag: 32 bits (unsigned integer) 🔥
Okay, this one is lowkey the most important field 😭 The receiver uses the Verification Tag to validate the sender of this SCTP packet. On transmit, the value of this Verification Tag MUST be set to the value of the Initiate Tag received from the peer endpoint during the association initialization, with the following exceptions:
- A packet containing an INIT chunk MUST have a zero Verification Tag.
- A packet containing a SHUTDOWN-COMPLETE chunk with the T-bit set MUST have the Verification Tag copied from the packet with the SHUTDOWN-ACK chunk.
- A packet containing an ABORT chunk may have the verification tag copied from the packet which caused the ABORT to be sent. For details see Section 8.4 and 8.5. 🙈
An INIT chunk MUST be the only chunk in the SCTP packet carrying it. No sharing the INIT, it's giving "I'm the only one at this party" 🧚
Checksum: 32 bits (unsigned integer) 🍓
This field contains the checksum of this SCTP packet. Its calculation is discussed in Section 6.8. SCTP uses the Adler-32 algorithm as described in Appendix B for calculating the checksum. 🌈
3.2. Chunk Field Descriptions ✨
Okay so every chunk is formatted with a Chunk Type field, a chunk-specific Flag field, a Chunk Length field, and a Value field. Here's the layout 🎀
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Chunk Type | Chunk Flags | Chunk Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
\ \
/ Chunk Value /
\ \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Chunk Type: 8 bits (unsigned integer) 💜
This field identifies the type of information contained in the Chunk Value field. It takes a value from 0 to 254. The value of 255 is reserved for future use as an extension field.
The values of Chunk Types are defined as follows:
ID Value Chunk Type
----- ----------
0 - Payload Data (DATA)
1 - Initiation (INIT)
2 - Initiation Acknowledgement (INIT ACK)
3 - Selective Acknowledgement (SACK)
4 - Heartbeat Request (HEARTBEAT)
5 - Heartbeat Acknowledgement (HEARTBEAT ACK)
6 - Abort (ABORT)
7 - Shutdown (SHUTDOWN)
8 - Shutdown Acknowledgement (SHUTDOWN ACK)
9 - Operation Error (ERROR)
10 - State Cookie (COOKIE ECHO)
11 - Cookie Acknowledgement (COOKIE ACK)
12 - Reserved for Explicit Congestion Notification Echo (ECNE)
13 - Reserved for Congestion Window Reduced (CWR)
14 - Shutdown Complete (SHUTDOWN COMPLETE)
15 to 62 - reserved by IETF
63 - IETF-defined Chunk Extensions
64 to 126 - reserved by IETF
127 - IETF-defined Chunk Extensions
128 to 190 - reserved by IETF
191 - IETF-defined Chunk Extensions
192 to 254 - reserved by IETF
255 - IETF-defined Chunk ExtensionsChunk Types are encoded so that the highest-order two bits specify the action that must be taken if the processing endpoint does not recognize the Chunk Type. It's giving "the top two bits are the instructions" 🧠
00 - Stop processing this SCTP packet and discard it, do not process
any further chunks within it.
01 - Stop processing this SCTP packet and discard it, do not process
any further chunks within it, and report the unrecognized
parameter in an 'Unrecognized Parameter Type' (in either an
ERROR or in the INIT ACK).
10 - Skip this chunk and continue processing.
11 - Skip this chunk and continue processing, but report in an ERROR
Chunk using the 'Unrecognized Chunk Type' cause of error.Note: The ECNE and CWR chunk types are reserved for future use of Explicit Congestion Notification (ECN). Reserved means hands off for now, bestie 🚫
Chunk Flags: 8 bits 🌷
The usage of these bits depends on the chunk type as given by the Chunk Type. Unless otherwise specified, they are set to zero on transmit and are ignored on receipt.
Chunk Length: 16 bits (unsigned integer) 📏
This value represents the size of the chunk in bytes, including the Chunk Type, Chunk Flags, Chunk Length, and Chunk Value fields. So if the Chunk Value field is zero-length, the Length field will be set to 4. The Chunk Length field does not count any padding. Padding is the sneaky friend nobody counts 🙃
Chunk Value: variable length 🦄
The Chunk Value field contains the actual information transferred in the chunk. The usage and format of this field depend on the Chunk Type.
The total length of a chunk (including Type, Length and Value fields) MUST be a multiple of 4 bytes. If the length of the chunk is not a multiple of 4 bytes, the sender MUST pad the chunk with all zero bytes, and this padding is not included in the chunk length field. The sender should never pad with more than 3 bytes. The receiver MUST ignore the padding bytes. ✨
SCTP defined chunks are described in detail in Section 3.3. The guidelines for IETF-defined chunk extensions can be found in Section 13.1 of this document. 💅
3.2.1. Optional/Variable-length Parameter Format 🎀
Chunk values of SCTP control chunks consist of a chunk-type-specific header of required fields, followed by zero or more parameters. The optional and variable-length parameters in a chunk are defined in a Type-Length-Value format, shown below. Think of it as a little labelled gift box 🎁
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Parameter Type | Parameter Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
\ \
/ Parameter Value /
\ \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Chunk Parameter Type: 16 bits (unsigned integer) 🧁
The Type field is a 16 bit identifier of the type of parameter. It takes a value of 0 to 65534.
The value of 65535 is reserved for IETF-defined extensions. Values other than those defined in specific SCTP chunk descriptions are reserved for use by IETF. 🔒
Chunk Parameter Length: 16 bits (unsigned integer) 📐
The Parameter Length field contains the size of the parameter in bytes, including the Parameter Type, Parameter Length, and Parameter Value fields. So a parameter with a zero-length Parameter Value field would have a Length field of 4. The Parameter Length does not include any padding bytes.
Chunk Parameter Value: variable-length. 🌺
The Parameter Value field contains the actual information transferred in the parameter.
The total length of a parameter (including Type, Parameter Length and Value fields) MUST be a multiple of 4 bytes. If the length of the parameter is not a multiple of 4 bytes, the sender pads the Parameter at the end (i.e., after the Parameter Value field) with all zero bytes. The length of the padding is not included in the parameter length field. A sender SHOULD NOT pad with more than 3 bytes. The receiver MUST ignore the padding bytes. 🫶
The Parameter Types are encoded so that the highest-order two bits specify the action that must be taken if the processing endpoint does not recognize the Parameter Type. Same vibe as the chunk types, just one level down 🔁
00 - Stop processing this SCTP packet and discard it, do not process
any further chunks within it.
01 - Stop processing this SCTP packet and discard it, do not process
any further chunks within it, and report the unrecognized
parameter in an 'Unrecognized Parameter Type' (in either an
ERROR or in the INIT ACK).
10 - Skip this parameter and continue processing.
11 - Skip this parameter and continue processing but report the
unrecognized parameter in an 'Unrecognized Parameter Type' (in
either an ERROR or in the INIT ACK).The actual SCTP parameters are defined in the specific SCTP chunk sections. The rules for IETF-defined parameter extensions are defined in Section 13.2. 🌟
3.3. SCTP Chunk Definitions 🦋
Okay, this is where the actual chunk types get their own sections, so let's go 🚀
This section defines the format of the different SCTP chunk types. 💖
3.3.1 Payload Data (DATA) (0) 💖
okay bestie, the DATA chunk is where the actual user data lives 🎀 and this is the exact layout it MUST use. no switching it up 😤
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 0 | Reserved|U|B|E| Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| TSN |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Stream Identifier S | Stream Sequence Number n |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Payload Protocol Identifier |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
\ \
/ User Data (seq n of Stream S) /
\ \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Reserved: 5 bits 🧹 these should be set to all '0's, and the receiver just ignores them. no drama.
U bit: 1 bit 🦋 the (U)nordered bit. if it's '1', this DATA chunk is unordered and it has no Stream Sequence Number at all. so the receiver MUST ignore the Stream Sequence Number field. ✨
once everything is reassembled (if it needed to be), the receiver MUST send unordered DATA chunks up to the upper layer right away, without trying to put them back in order. no reordering for these queens 👑
and if an unordered user message gets fragmented, EVERY fragment MUST have its U bit set to '1'. 🫶
B bit: 1 bit 🌸 the (B)eginning fragment bit. if it's set, this is the first fragment of a user message.
E bit: 1 bit 🌈 the (E)nding fragment bit. if it's set, this is the last fragment of a user message.
an unfragmented user message shall have both the B and E bits set to '1'. and setting both B and E to '0' means it's a middle piece of a multi-fragment message. here's the cheat sheet 📋
B E Description
============================================================
| 1 0 | First piece of a fragmented user message |
+----------------------------------------------------------+
| 0 0 | Middle piece of a fragmented user message |
+----------------------------------------------------------+
| 0 1 | Last piece of a fragmented user message |
+----------------------------------------------------------+
| 1 1 | Unfragmented Message |
============================================================
| Table 1: Fragment Description Flags |
============================================================when a user message gets chopped into multiple chunks, the receiver uses the TSNs to stitch it back together 🧩 which means the TSNs for each fragment of a fragmented user message MUST be strictly sequential. no skipping, no shuffling, we are NOT doing that 😭
Length: 16 bits (unsigned integer) 📏 this is how many bytes the DATA chunk is, counting from the start of the type field to the end of the user data field. padding doesn't count. and a DATA chunk with no user data field has Length set to 16 (that's 16 bytes, periodt) 💅
TSN: 32 bits (unsigned integer) 🔢 this is the TSN for this DATA chunk. valid range is 0 to 4294967295 (that's 2**32 - 1). and after it hits 4294967295 it wraps right back to 0 🔄
Stream Identifier S: 16 bits (unsigned integer) 🧚 tells you which stream the following user data belongs to.
Stream Sequence Number n: 16 bits (unsigned integer) 🍓 this is the stream sequence number of the user data inside stream S. valid range is 0 to 65535.
when SCTP fragments a user message for transport, every single fragment MUST carry the SAME stream sequence number. consistency is everything bestie 🫶
Payload Protocol Identifier: 32 bits (unsigned integer) 🎀 this is an identifier the application (or upper layer) picks. the upper layer hands it to SCTP and it gets sent to the peer. SCTP doesn't use it itself, but network middleboxes and the peer app can use it to figure out what kind of info is inside this DATA chunk 🕵️♀️ and it MUST be sent even in fragmented DATA chunks, so agents in the middle of the network can still see it. ✨
the value 0 means the upper layer didn't specify any application identifier for this payload. 🙈
User Data: variable length 💜 this is the actual payload user data. the implementation MUST pad the end of the data to a 4 byte boundary using all-zero bytes. padding MUST NOT be counted in the length field, and a sender MUST never add more than 3 bytes of padding. we're keeping it tidy 🧼
3.3.2 Initiation (INIT) (1) 🚀
this chunk is how two endpoints kick off an SCTP association. it's the "hiii, wanna be friends?" moment 🥹 here's the format:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 1 | Chunk Flags | Chunk Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Initiate Tag |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Advertised Receiver Window Credit (a_rwnd) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Number of Outbound Streams | Number of Inbound Streams |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Initial TSN |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
\ \
/ Optional/Variable-Length Parameters /
\ \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+the INIT chunk carries these parameters. unless it says otherwise, each parameter MUST only show up ONCE in the INIT chunk 🔒
Fixed Parameters Status
----------------------------------------------
Initiate Tag Mandatory
Advertised Receiver Window Credit Mandatory
Number of Outbound Streams Mandatory
Number of Inbound Streams Mandatory
Initial TSN Mandatory
Variable Parameters Status Type Value
-------------------------------------------------------------
IPv4 Address (Note 1) Optional 5
IPv6 Address (Note 1) Optional 6
Cookie Preservative Optional 9
Reserved for ECN Capable (Note 2) Optional 32768 (0x8000)
Host Name Address (Note 3) Optional 11
Supported Address Types (Note 4) Optional 12Note 1: the INIT chunk can have multiple addresses, IPv4 and/or IPv6, in any mix you like 🌍
Note 2: the ECN capable field is reserved for future Explicit Congestion Notification stuff 🔮
Note 3: this one's a bit strict, ngl 🙃 an INIT chunk MUST NOT contain more than one Host Name address parameter. the sender of the INIT MUST NOT mix any other address types in with the Host Name address either. and if the Host Name address parameter shows up in a received INIT, the receiver of INIT MUST ignore any other address types.
Note 4: when this parameter is there, it lists ALL the address types the sending endpoint can support. if it's missing, that means the sender can support any address type 🤷♀️
the Chunk Flags field in INIT is reserved. all its bits should be set to 0 by the sender and ignored by the receiver. and the parameters inside an INIT can be processed in any order, no pressure 🦋
Initiate Tag: 32 bits (unsigned integer) 🏷️ the receiver of the INIT (the responding end) records the Initiate Tag value. that value MUST be put into the Verification Tag field of every SCTP packet that the INIT receiver sends within this association.
the Initiate Tag can be any value EXCEPT 0. check Section 5.3.1 for more on how to pick the tag value 👀
if a received INIT chunk has an Initiate Tag of 0, the receiver MUST treat that as an error and close the association by sending an ABORT. 💀
Advertised Receiver Window Credit (a_rwnd): 32 bits (unsigned integer) 🪟 this is the dedicated buffer space, in bytes, that the INIT sender has set aside for this association. during the life of the association this buffer space SHOULD not be lessened (so don't yank dedicated buffers away from the association). but an endpoint MAY change the a_rwnd value it sends in SACK chunks. flexible, but not rude 💖
Number of Outbound Streams (OS): 16 bits (unsigned integer) ➡️ how many outbound streams the INIT sender wants to create in this association. the value of 0 MUST NOT be used.
Note: a receiver of an INIT with the OS value set to 0 SHOULD abort the association. 🚫
Number of Inbound Streams (MIS): 16 bits (unsigned integer) ⬅️ the max number of streams the INIT sender lets the peer create in this association. the value 0 MUST NOT be used.
Note: there's no real negotiation of the stream count. instead the two endpoints both use the min(requested, offered). see Section 5.1.1 for the details 🤓
Note: a receiver of an INIT with the MIS value of 0 SHOULD abort the association. 🚫
Initial TSN (I-TSN): 32 bits (unsigned integer) 🔢 the initial TSN the sender is going to use. valid range is 0 to 4294967295. this field MAY be set to the same value as the Initiate Tag field, if you're feeling it ✨
3.3.2.1 Optional/Variable Length Parameters in INIT ✨
okay so these optional parameters all follow the Type-Length-Value format from Section 3.2.1 🎀 and bestie, any TLV fields MUST come after the fixed-length fields from the section before this one. no exceptions 💅
IPv4 Address Parameter (5) 🦋
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 5 | Length = 8 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| IPv4 Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+IPv4 Address: 32 bits (unsigned integer) 🌸
this one carries an IPv4 address of the sending endpoint, binary encoded (no vibes, just bits) 🤖
IPv6 Address Parameter (6) 🌈
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 6 | Length = 20 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
| IPv6 Address |
| |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+IPv6 Address: 128 bit (unsigned integer) 🧚
same energy as the IPv4 one: it's an IPv6 address of the sending endpoint, binary encoded 💖
✨ Note: a sender MUST NOT use an IPv4-mapped IPv6 address [RFC2373] 🙅♀️ it should use an IPv4 Address Parameter for an IPv4 address instead. obsessed with this rule, honestly 😭
okay now the good part 👑 the value in an IPv4 or IPv6 Address parameter, combined with the Source Port Number in the SCTP common header, tells you a transport address the INIT sender will support for the association being started. so during the whole lifetime of that association, this IP address can show up in the source address field of an IP datagram sent by the INIT sender, AND it can be used as a destination address for an IP datagram sent by the INIT receiver. iconic, right? 🦋
more than one IP Address parameter can be in an INIT chunk when the INIT sender is multi-homed 🏠🏠 and a multi-homed endpoint might have access to different kinds of network, so one INIT chunk can hold more than one address type. IPv4 and IPv6 addresses are both allowed in the same INIT chunk, slay 💅
here's the main rule for when there are address parameters. if the INIT has at least one IP Address parameter, then the source address of the IP datagram carrying the INIT chunk, plus any extra address(es) inside the INIT, can be used as destinations by the endpoint receiving the INIT 🎀 but if the INIT has NO IP Address parameters, the receiving endpoint MUST use the source address of the received IP datagram as its one and only destination address for the association. that's the whole deal 🫶
and lowkey, not using any IP address parameters in the INIT and INIT-ACK is an alternative for making an association more likely to work across a NAT box 🙈
Cookie Preservative (9) 🍓
the sender of the INIT shall use this parameter to suggest to the receiver of the INIT that it wants a longer life-span for the State Cookie. main character energy 👑
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 9 | Length = 8 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Suggested Cookie Life-span Increment (msec.) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Suggested Cookie Life-span Increment: 32 bits (unsigned integer) ⭐
this tells the receiver how many extra milliseconds the sender would like it to add to its default cookie life-span ⏰
this optional parameter should be added to the INIT chunk by the sender when it's re-trying to set up an association with a peer where the last attempt failed because of a stale cookie operation error 😭 the receiver MAY choose to ignore the suggested cookie life-span increase for its own security reasons 🔐 it's the receiver's call, bestie 💅
Host Name Address (11) 🌸
the sender of INIT uses this parameter to pass its Host Name (instead of its IP addresses) to its peer 🍓 the peer is responsible for resolving the name, and using this parameter might make it more likely for the association to work across a NAT box 🙈
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 11 | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
/ Host Name /
\ \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Host Name: variable length 🧸
this field holds a host name in "host name syntax" per RFC1123 Section 2.1 [RFC1123] ✨ how the host name gets resolved is out of scope for SCTP, so that's not this spec's problem 🤷♀️
💀 Note: at least one null terminator is included in the Host Name string and must be included in the length. don't forget it, periodt 💅
Supported Address Types (12) 🧚♀️
the sender of INIT uses this parameter to list all the address types it can support 🌈
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 12 | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Address Type #1 | Address Type #2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ......
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Address Type: 16 bits (unsigned integer) 🦋
each one is filled with the type value of the matching address TLV, like IPv4 = 5, IPv6 = 6, and Hostname = 11 💖 so the list basically points back to the parameters we just met 🫶
3.3.3 Initiation Acknowledgement (INIT ACK) (2): ✨
Okay bestie, the INIT ACK chunk is the reply that says "yes, I got your INIT, let's start this association" 💖 It acknowledges that an SCTP association is being initiated 🦋
The parameter part of INIT ACK is formatted pretty much like the INIT chunk, but it adds two extra variable parameters: the State Cookie and the Unrecognized Parameter 🎀
Here's what the INIT ACK chunk looks like 👑
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 2 | Chunk Flags | Chunk Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Initiate Tag |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Advertised Receiver Window Credit |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Number of Outbound Streams | Number of Inbound Streams |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Initial TSN |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
\ \
/ Optional/Variable-Length Parameters /
\ \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Initiate Tag: 32 bits (unsigned integer) 🌸
The receiver of the INIT ACK records the value of the Initiate Tag parameter. This value MUST be placed into the Verification Tag field of every SCTP packet that the INIT ACK receiver transmits within this association 💅
The Initiate Tag MUST NOT take the value 0. See Section 5.3.1 for more on how the Initiate Tag value gets selected ✨
If the value of the Initiate Tag in a received INIT ACK chunk is found to be 0, the receiver MUST treat it as an error and close the association by transmitting an ABORT. Not me sending a 0 and then being surprised 💀
Advertised Receiver Window Credit (a_rwnd): 32 bits (unsigned integer) 🦋
This value represents the dedicated buffer space, in number of bytes, that the sender of the INIT ACK has reserved in association with this window. During the life of the association this buffer space SHOULD not be lessened (i.e. dedicated buffers taken away from this association). Basically, don't take back the space you promised 🫶
Number of Outbound Streams (OS): 16 bits (unsigned integer) 🧚
This defines the number of outbound streams the sender of this INIT ACK chunk wishes to create in this association. The value of 0 MUST NOT be used.
Note: A receiver of an INIT ACK with the OS value set to 0 SHOULD destroy the association, discarding its TCB. Zero streams is a vibe check you should not pass 😭
Number of Inbound Streams (MIS) : 16 bits (unsigned integer) 🍓
This defines the maximum number of streams the sender of this INIT ACK chunk allows the peer end to create in this association. The value 0 MUST NOT be used.
Note: There is no negotiation of the actual number of streams. Instead, the two endpoints will use the min(requested, offered). See Section 5.1.1 for details. Lowkey the smaller number wins, no drama 👑
Note: A receiver of an INIT ACK with the MIS value set to 0 SHOULD destroy the association, discarding its TCB.
Initial TSN (I-TSN) : 32 bits (unsigned integer) 💜
This defines the initial TSN that the INIT-ACK sender will use. The valid range is from 0 to 4294967295. This field MAY be set to the value of the Initiate Tag field. Totally optional but iconic if you do 🌈
Here's the table of fixed and variable parameters, so you can see what's mandatory and what's optional 🎀
Fixed Parameters Status
----------------------------------------------
Initiate Tag Mandatory
Advertised Receiver Window Credit Mandatory
Number of Outbound Streams Mandatory
Number of Inbound Streams Mandatory
Initial TSN Mandatory
Variable Parameters Status Type Value
-------------------------------------------------------------
State Cookie Mandatory 7
IPv4 Address (Note 1) Optional 5
IPv6 Address (Note 1) Optional 6
Unrecognized Parameters Optional 8
Reserved for ECN Capable (Note 2) Optional 32768 (0x8000)
Host Name Address (Note 3) Optional 11Note 1: The INIT ACK chunks can contain any number of IP address parameters, which can be IPv4 and/or IPv6 in any combination. Mix and match, it's giving flexibility 🦋
Note 2: The ECN capable field is reserved for future use of Explicit Congestion Notification 🔥
Note 3: The INIT ACK chunks MUST NOT contain more than one Host Name address parameter. Moreover, the sender of the INIT ACK MUST NOT combine any other address types with the Host Name address in the INIT ACK. The receiver of the INIT ACK MUST ignore any other address types if the Host Name address parameter is present. One Host Name, no sidekicks 🙈
IMPLEMENTATION NOTE: An implementation MUST be prepared to receive an INIT ACK that is quite large (more than 1500 bytes) due to the variable size of the state cookie AND the variable address list. For example, if a responder to the INIT has 1000 IPv4 addresses it wishes to send, it would need at least 8,000 bytes to encode this in the INIT ACK. Big chunks are valid chunks, bestie 😭✨
In combination with the Source Port carried in the SCTP common header, each IP Address parameter in the INIT ACK indicates to the receiver of the INIT ACK a valid transport address supported by the sender of the INIT ACK for the lifetime of the association being initiated 🧚
If the INIT ACK contains at least one IP Address parameter, then the source address of the IP datagram containing the INIT ACK and any additional address(es) provided within the INIT ACK may be used as destinations by the receiver of the INIT-ACK. If the INIT ACK does not contain any IP Address parameters, the receiver of the INIT-ACK MUST use the source address associated with the received IP datagram as its sole destination address for the association. No addresses listed? Then you just reply to where it came from 💅
The State Cookie and Unrecognized Parameters use the Type-Length-Value format defined in Section 3.2.1 and are described below. The other fields are defined the same as their counterparts in the INIT chunk 🌸
3.3.3.1 Optional or Variable Length Parameters 🎀
State Cookie 🍓
Parameter Type Value: 7
Parameter Length: variable size, depending on Size of Cookie
Parameter Value:
This parameter value MUST contain all the necessary state and parameter information required for the sender of this INIT ACK to create the association, along with a Message Authentication Code (MAC). See Section 5.1.3 for details on the State Cookie definition. The cookie is literally carrying the whole association in it, iconic 👑
Unrecognized Parameters: 🫶
Parameter Type Value: 8
Parameter Length: Variable Size.
Parameter Value:
This parameter is returned to the originator of the INIT chunk when the INIT contains an unrecognized parameter that has a value indicating it should be reported to the sender. This parameter value field will contain unrecognized parameters copied from the INIT chunk, complete with Parameter Type, Length and Value fields. Receipts, but make it protocol 🧾💖
3.3.4 Selective Acknowledgement (SACK) (3): 💌
Okay bestie, this chunk is the SACK, and it gets sent to the peer endpoint to acknowledge the DATA chunks that came in. It also tells the peer about the gaps in the TSNs it has received so far 🫶
The SACK MUST contain the Cumulative TSN Ack and Advertised Receiver Window Credit (a_rwnd) parameters. 🎀
So the Cumulative TSN Ack is the last TSN received before the sequence breaks. The next TSN after that one hasn't shown up yet at the endpoint sending the SACK. This parameter acknowledges receipt of every TSN less than or equal to its value, so it's giving clean and organized 🧚
How the receiver of the SACK handles a_rwnd is explained in detail in Section 6.2.1 💅
The SACK can also have zero or more Gap Ack Blocks. Each Gap Ack Block acknowledges a run of TSNs that arrived after a break in the sequence. Every TSN acknowledged by a Gap Ack Block is greater than the Cumulative TSN Ack, so no overlap, no drama 🌈
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 3 |Chunk Flags | Chunk Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Cumulative TSN Ack |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Advertised Receiver Window Credit (a_rwnd) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Number of Gap Ack Blocks = N | Number of Duplicate TSNs = X |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Gap Ack Block #1 Start | Gap Ack Block #1 End |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
/ /
\ ... \
/ /
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Gap Ack Block #N Start | Gap Ack Block #N End |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Duplicate TSN 1 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
/ /
\ ... \
/ /
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Duplicate TSN X |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Chunk Flags: 8 bits 🍓
Set to all zeros on transmit and ignored on receipt.
Cumulative TSN Ack: 32 bits (unsigned integer) 🌸
This parameter contains the TSN of the last DATA chunk received in sequence before a gap.
Advertised Receiver Window Credit (a_rwnd): 32 bits (unsigned integer) 🦋
This field indicates the updated receive buffer space in bytes of the sender of this SACK. See Section 6.2.1 for details.
Number of Gap Ack Blocks: 16 bits (unsigned integer) ✨
Indicates the number of Gap Ack Blocks included in this SACK.
Number of Duplicate TSNs: 16 bit 💜
This field contains the number of duplicate TSNs the endpoint has received. Each duplicate TSN is listed following the Gap Ack Block list.
Gap Ack Blocks: 🧚
These fields contain the Gap Ack Blocks. They are repeated for each Gap Ack Block, up to the number of Gap Ack Blocks defined in the Number of Gap Ack Blocks field. All DATA chunks with TSNs greater than or equal to (Cumulative TSN Ack + Gap Ack Block Start) and less than or equal to (Cumulative TSN Ack + Gap Ack Block End) of each Gap Ack Block are assumed to have been received correctly. 🙈
Gap Ack Block Start: 16 bits (unsigned integer) 🎀
Indicates the Start offset TSN for this Gap Ack Block. To calculate the actual TSN number, the Cumulative TSN Ack is added to this offset number. This calculated TSN identifies the first TSN in this Gap Ack Block that has been received.
Gap Ack Block End: 16 bits (unsigned integer) 🌈
Indicates the End offset TSN for this Gap Ack Block. To calculate the actual TSN number, the Cumulative TSN Ack is added to this offset number. This calculated TSN identifies the TSN of the last DATA chunk received in this Gap Ack Block.
Here's an example. Say the receiver has the following DATA chunks newly arrived at the moment it decides to send a Selective ACK 👑
----------
| TSN=17 |
----------
| | <- still missing
----------
| TSN=15 |
----------
| TSN=14 |
----------
| | <- still missing
----------
| TSN=12 |
----------
| TSN=11 |
----------
| TSN=10 |
----------Then the parameter part of the SACK MUST be constructed as follows (assuming the new a_rwnd is set to 4660 by the sender) 💅
+--------------------------------+
| Cumulative TSN Ack = 12 |
+--------------------------------+
| a_rwnd = 4660 |
+----------------+---------------+
| num of block=2 | num of dup=0 |
+----------------+---------------+
|block #1 strt=2 |block #1 end=3 |
+----------------+---------------+
|block #2 strt=5 |block #2 end=5 |
+----------------+---------------+Duplicate TSN: 32 bits (unsigned integer) 🔥
Indicates the number of times a TSN was received in duplicate since the last SACK was sent. Every time a receiver gets a duplicate TSN (before sending the SACK), it adds that TSN to the list of duplicates. The duplicate count is re-initialized to zero after sending each SACK.
For example, if a receiver gets the TSN 19 three times, it would list 19 twice in the outbound SACK. After sending the SACK, if it receives yet one more TSN 19, it would list 19 as a duplicate once in the next outgoing SACK. 😭
3.3.5 Heartbeat Request (HEARTBEAT) (4): 💓
An endpoint should send this chunk to its peer endpoint to probe the reachability of a particular destination transport address defined in the present association. 🦋
The parameter field contains the Heartbeat Information, which is a variable-length opaque data structure understood only by the sender. 🔮
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 4 | Chunk Flags | Heartbeat Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
\ \
/ Heartbeat Information TLV (Variable-Length) /
\ \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Chunk Flags: 8 bits 🍓
Set to zero on transmit and ignored on receipt.
Heartbeat Length: 16 bits (unsigned integer) 🌸
Set to the size of the chunk in bytes, including the chunk header and the Heartbeat Information field.
Heartbeat Information: variable length 🧚
Defined as a variable-length parameter using the format described in Section 3.2.1, i.e.:
Variable Parameters Status Type Value
-------------------------------------------------------------
Heartbeat Info Mandatory 1 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Heartbeat Info Type=1 | HB Info Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
/ Sender-specific Heartbeat Info /
\ \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+The Sender-specific Heartbeat Info field should normally include information about the sender's current time when this HEARTBEAT chunk is sent, and the destination transport address to which this HEARTBEAT is sent (see Section 8.3). ⏰
3.3.6 Heartbeat Acknowledgement (HEARTBEAT ACK) (5): 🫧
An endpoint should send this chunk to its peer endpoint as a response to a HEARTBEAT chunk (see Section 8.3). A HEARTBEAT ACK is always sent to the source IP address of the IP datagram containing the HEARTBEAT chunk to which this ack is responding. 📬
The parameter field contains a variable-length opaque data structure. 💜
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 5 | Chunk Flags | Heartbeat Ack Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
\ \
/ Heartbeat Information TLV (Variable-Length) /
\ \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Chunk Flags: 8 bits 🍓
Set to zero on transmit and ignored on receipt.
Heartbeat Ack Length: 16 bits (unsigned integer) 🌸
Set to the size of the chunk in bytes, including the chunk header and the Heartbeat Information field.
Heartbeat Information: variable length 🎀
This field MUST contain the Heartbeat Information parameter of the Heartbeat Request to which this Heartbeat Acknowledgement is responding. 🫶
Variable Parameters Status Type Value
-------------------------------------------------------------
Heartbeat Info Mandatory 13.3.7 Abort Association (ABORT) (6) ✨
okay so the ABORT chunk is how you close an association with your peer 🙅♀️ it can carry Cause Parameters to tell the receiver why the abort happened, which is so helpful ngl 💅 DATA chunks MUST NOT be bundled with ABORT 💀 no sneaking them in. Control chunks (except for INIT, INIT ACK and SHUTDOWN COMPLETE) MAY be bundled with an ABORT, but they MUST be placed before the ABORT in the SCTP packet, or the receiver will ignore them. placement is everything, bestie 🎀
If an endpoint gets an ABORT with a format error, or one for an association that doesn't exist, it MUST silently discard it 🙈 and no matter what happens, an endpoint that receives an ABORT MUST NOT respond to it by sending an ABORT of its own. no ABORT ping-pong allowed 🙅♀️💜
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 6 |Reserved |T| Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
\ \
/ zero or more Error Causes /
\ \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Chunk Flags: 8 bits 🧁
Reserved: 7 bits 🫶 set to 0 on transmit and ignored on receipt.
T bit: 1 bit 🦋 the T bit is set to 0 if the sender had a TCB that it destroyed. if the sender did not have a TCB, it should set this bit to 1.
Note: special rules apply to this chunk for verification, so check out Section 8.5.1 for the details 👀
Length: 16 bits (unsigned integer) 📏 set to the size of the chunk in bytes, including the chunk header and all the Error Cause fields present.
See Section 3.3.10 for Error Cause definitions 🌸
3.3.8 Shutdown Association (SHUTDOWN) (7) 🌈
an endpoint in an association MUST use this chunk to start a graceful close of the association with its peer 🫶 it looks like this:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 7 | Chunk Flags | Length = 8 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Cumulative TSN Ack |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Chunk Flags: 8 bits 🧁 set to zero on transmit and ignored on receipt.
Length: 16 bits (unsigned integer) 📏 indicates the length of the parameter. set to 8.
Cumulative TSN Ack: 32 bits (unsigned integer) 💖 this parameter contains the TSN of the last chunk received in sequence before any gaps.
Note: since the SHUTDOWN message doesn't contain Gap Ack Blocks, it can't be used to acknowledge TSNs that arrived out of order. in a SACK, a lack of Gap Ack Blocks that were previously included means the data receiver reneged on the associated DATA chunks. but since SHUTDOWN doesn't contain Gap Ack Blocks, the receiver of the SHUTDOWN shouldn't read a missing Gap Ack Block as a renege 🙈 (see Section 6.2 for info on reneging)
3.3.9 Shutdown Acknowledgement (SHUTDOWN ACK) (8) 🍓
this chunk MUST be used to acknowledge receipt of the SHUTDOWN chunk once the shutdown process is complete ✨ see Section 9.2 for the details.
The SHUTDOWN ACK chunk has no parameters 🧚
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 8 |Chunk Flags | Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Chunk Flags: 8 bits 🧁 set to zero on transmit and ignored on receipt.
3.3.10 Operation Error (ERROR) (9) 🚨
an endpoint sends this chunk to its peer to say "hey, something's off" 🙈 it holds one or more error causes. an Operation Error isn't fatal on its own, but it can be paired with an ABORT chunk to report a fatal condition. it has these parameters:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 9 | Chunk Flags | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
\ \
/ one or more Error Causes /
\ \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Chunk Flags: 8 bits 🧁 set to zero on transmit and ignored on receipt.
Length: 16 bits (unsigned integer) 📏 set to the size of the chunk in bytes, including the chunk header and all the Error Cause fields present.
Error causes are defined as variable-length parameters using the format from 3.2.1, i.e.:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Cause Code | Cause Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
/ Cause-specific Information /
\ \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Cause Code: 16 bits (unsigned integer) 🔥 defines the type of error being reported:
Cause Code
Value Cause Code
--------- ----------------
1 Invalid Stream Identifier
2 Missing Mandatory Parameter
3 Stale Cookie Error
4 Out of Resource
5 Unresolvable Address
6 Unrecognized Chunk Type
7 Invalid Mandatory Parameter
8 Unrecognized Parameters
9 No User Data
10 Cookie Received While Shutting DownCause Length: 16 bits (unsigned integer) 📏 set to the size of the parameter in bytes, including the Cause Code, Cause Length, and Cause-Specific Information fields.
Cause-specific Information: variable length 💅 this field carries the details of the error.
Sections 3.3.10.1 - 3.3.10.10 define the error causes for SCTP ✨ guidelines for the IETF to define new error cause values are in Section 13.3.
3.3.10.1 Invalid Stream Identifier (1) 🦋
Cause of error 💀 Invalid Stream Identifier: the endpoint received a DATA chunk sent to a stream that doesn't exist.
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Cause Code=1 | Cause Length=8 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Stream Identifier | (Reserved) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Stream Identifier: 16 bits (unsigned integer) 🎀 contains the Stream Identifier of the DATA chunk that was received in error.
Reserved: 16 bits 🧊 this field is reserved. it is set to all 0's on transmit and Ignored on receipt.
3.3.10.2 Missing Mandatory Parameter (2) 🍓
Cause of error 💀 Missing Mandatory Parameter: one or more mandatory TLV parameters are missing from a received INIT or INIT ACK.
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Cause Code=2 | Cause Length=8+N*2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Number of missing params=N |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Missing Param Type #1 | Missing Param Type #2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Missing Param Type #N-1 | Missing Param Type #N |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Number of Missing params: 32 bits (unsigned integer) 🔢 this field contains the number of parameters in the Cause-specific Information field.
Missing Param Type: 16 bits (unsigned integer) 🧩 each field contains the number of a missing mandatory parameter.
3.3.10.3 Stale Cookie Error (3) 🕰️
Cause of error 💀 Stale Cookie Error: a valid State Cookie was received, but it has expired.
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Cause Code=3 | Cause Length=8 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Measure of Staleness (usec.) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Measure of Staleness: 32 bits (unsigned integer) ⏱️ this field contains the difference, in microseconds, between the current time and the time the State Cookie expired.
The sender of this error cause MAY choose to report how long past expiration the State Cookie is, by including a non-zero value in the Measure of Staleness field 🌟 if the sender doesn't want to share that, it should set the Measure of Staleness field to zero.
3.3.10.4 Out of Resource (4) 🪫
Cause of error 💀 Out of Resource: the sender is out of resources. this is usually sent together with, or inside, an ABORT.
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Cause Code=4 | Cause Length=4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+3.3.10.5 Unresolvable Address (5) 🗺️
Cause of error 💀 Unresolvable Address: the sender can't resolve the address parameter it was given (for example, the address type isn't supported by the sender). this is usually sent together with, or inside, an ABORT.
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Cause Code=5 | Cause Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
/ Unresolvable Address /
\ \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Unresolvable Address: variable length 💜 the unresolvable address field contains the complete Type, Length and Value of the address parameter (or Host Name parameter) that holds the unresolvable address or host name.
3.3.10.6 Unrecognized Chunk Type (6) 🦋
Cause of error 💀
Okay so this one is for when the receiver doesn't understand a chunk and the upper bits of the Chunk Type are set to 01 or 11. The error gets sent back to whoever sent that chunk so they know what happened 🫶
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Cause Code=6 | Cause Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
/ Unrecognized Chunk /
\ \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Unrecognized Chunk: variable length 🎀
This field holds the unrecognized chunk straight from the SCTP packet, complete with its Chunk Type, Chunk Flags, and Chunk Length. Full receipts, bestie 📦✨
3.3.10.7 Invalid Mandatory Parameter (7) 🌸
Cause of error 💀
This one gets sent back to whoever originated an INIT or INIT ACK chunk when one of the mandatory parameters has an invalid value. Not it 🙈
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Cause Code=7 | Cause Length=4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+3.3.10.8 Unrecognized Parameters (8) 🧚
Cause of error 💀
This is for when the receiver doesn't recognize one or more Optional TLV parameters in an INIT ACK chunk. It goes back to the originator of that INIT ACK 💜
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Cause Code=8 | Cause Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
/ Unrecognized Parameters /
\ \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Unrecognized Parameters: variable length 🌈
This field holds the unrecognized parameters copied from the INIT ACK chunk, complete with TLV. Usually this cause sits inside an ERROR chunk that's bundled with the COOKIE ECHO chunk when responding to the INIT ACK, which is the moment the sender of the COOKIE ECHO wants to report the unrecognized parameters 🫶
3.3.10.9 No User Data (9) 🍓
Cause of error 💀
This goes back to the originator of a DATA chunk if the DATA chunk it sent arrives with no user data. Empty DATA chunk? Lowkey tragic 😭
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Cause Code=9 | Cause Length=8 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
/ TSN value /
\ \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+TSN value: 32 bits (+unsigned integer) 🔢
This field carries the TSN of the DATA chunk that showed up with no user data field.
This cause code is usually sent inside an ABORT chunk (see Section 6.2) 💅
3.3.10.10 Cookie Received While Shutting Down (10) 🌙
Cause of error 💀
This one happens when a COOKIE ECHO shows up while the endpoint is in SHUTDOWN-ACK-SENT state. It's usually bundled in an ERROR chunk along with the retransmitted SHUTDOWN ACK ✨
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Cause Code=10 | Cause Length=4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+3.3.11 Cookie Echo (COOKIE ECHO) (10) 🍬
This chunk is only used during association initialization, and it's the initiator's way of telling its peer to finish the setup process 🤝 It MUST precede any DATA chunk sent within the association, but it MAY be bundled with one or more DATA chunks in the same packet. Order matters, babe 👑
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 10 |Chunk Flags | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
/ Cookie /
\ \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Chunk Flags: 8 bit 🩷
Set to zero on transmit and ignored on receipt.
Length: 16 bits (unsigned integer) 📏
This is the size of the chunk in bytes, counting the 4 bytes of chunk header plus the size of the Cookie.
Cookie: variable size 🍪
This field must contain the exact cookie you got in the State Cookie parameter from the previous INIT ACK. No edits, no vibes-based changes 🙅♀️
An implementation SHOULD make the cookie as small as possible to keep interoperability solid 🫧
3.3.12 Cookie Acknowledgement (COOKIE ACK) (11) 🦢
This chunk is also only used during initialization. It's how you acknowledge that you got a COOKIE ECHO chunk. It MUST precede any DATA or SACK chunk sent within the association, but it MAY be bundled with one or more DATA chunks or a SACK chunk in the same SCTP packet 💖
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 11 |Chunk Flags | Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Chunk Flags: 8 bits 🌷
Set to zero on transmit and ignored on receipt.
3.3.13 Shutdown Complete (SHUTDOWN COMPLETE) (14) 🌸✨
This chunk MUST be used to acknowledge the receipt of the SHUTDOWN ACK chunk at the completion of the shutdown process. Check Section 9.2 for the full tea 🍵
The SHUTDOWN COMPLETE chunk has no parameters. Literally nothing extra, zero drama 🫶
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 14 |Reserved |T| Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Chunk Flags: 8 bits 🩵
Reserved: 7 bits 🫧
Set to 0 on transmit and ignored on receipt.
T bit: 1 bit 🦋
The T bit is set to 0 if the sender had a TCB that it destroyed. If the sender did not have a TCB, it should set this bit to 1. Main character energy either way 👑
Note: Special rules apply to this chunk for verification, so check Section 8.5.1 for the details. Don't skip this one, it's serious 🙈
4. SCTP Association State Diagram ✨
okay so during the whole lifetime of an SCTP association, the endpoint's association keeps leveling up from one state to another in response to different events 💅 The events that can move an association's state along are:
- SCTP user primitive calls, e.g., [ASSOCIATE], [SHUTDOWN], [ABORT],
- Reception of INIT, COOKIE ECHO, ABORT, SHUTDOWN, etc., control chunks, or
- Some timeout events.
The state diagram below shows the state changes, plus the event that causes each one and what happens as a result 🦋 Some error conditions aren't in the diagram, so the full scoop on all the special cases lives in the text, bestie 🫶
----- -------- (frm any state)
/ \ / rcv ABORT [ABORT]
rcv INIT | | | ---------- or ----------
--------------- | v v delete TCB snd ABORT
generate Cookie \ +---------+ delete TCB
snd INIT ACK ---| CLOSED |
+---------+
/ \ [ASSOCIATE]
/ \ ---------------
| | create TCB
| | snd INIT
| | strt init timer
rcv valid | |
COOKIE ECHO | v
(1) ---------------- | +------------+
create TCB | | COOKIE-WAIT| (2)
snd COOKIE ACK | +------------+
| |
| | rcv INIT ACK
| | -----------------
| | snd COOKIE ECHO
| | stop init timer
| | strt cookie timer
| v
| +--------------+
| | COOKIE-ECHOED| (3)
| +--------------+
| |
| | rcv COOKIE ACK
| | -----------------
| | stop cookie timer
v v
+---------------+
| ESTABLISHED |
+---------------+
(from the ESTABLISHED state only)
|
|
/--------+--------\
[SHUTDOWN] / \
-------------------| |
check outstanding | |
DATA chunks | |
v |
+---------+ |
|SHUTDOWN-| | rcv SHUTDOWN/check
|PENDING | | outstanding DATA
+---------+ | chunks
| |------------------
No more outstanding | |
---------------------| |
snd SHUTDOWN | |
strt shutdown timer | |
v v
+---------+ +-----------+
(4) |SHUTDOWN-| | SHUTDOWN- | (5,6)
|SENT | | RECEIVED |
+---------+ +-----------+
| \ |
(A) rcv SHUTDOWN ACK | \ |
----------------------| \ |
stop shutdown timer | \rcv:SHUTDOWN |
send SHUTDOWN COMPLETE| \ (B) |
delete TCB | \ |
| \ | No more outstanding
| \ |-----------------
| \ | send SHUTDOWN ACK
(B)rcv SHUTDOWN | \ | strt shutdown timer
----------------------| \ |
send SHUTDOWN ACK | \ |
start shutdown timer | \ |
move to SHUTDOWN- | \ |
ACK-SENT | | |
| v |
| +-----------+
| | SHUTDOWN- | (7)
| | ACK-SENT |
| +----------+-
| | (C)rcv SHUTDOWN COMPLETE
| |-----------------
| | stop shutdown timer
| | delete TCB
| |
| | (D)rcv SHUTDOWN ACK
| |--------------
| | stop shutdown timer
| | send SHUTDOWN COMPLETE
| | delete TCB
| |
\ +---------+ /
\-->| CLOSED |<--/
+---------+
Figure 3: State Transition Diagram of SCTPNotes:
Quick heads up before the notes, babe: chunk names are in ALL CAPS, but parameter names only get a capital first letter, like COOKIE ECHO chunk type vs. State Cookie parameter 💖 And if more than one event or message can trigger the same transition, they get labeled (A), (B), and so on 🌈
- If the State Cookie in the received COOKIE ECHO is invalid (i.e., failed to pass the integrity check), the receiver MUST silently discard the packet. Or, if the received State Cookie is expired (see Section 5.1.5), the receiver MUST send back an ERROR chunk. In either case, the receiver stays in the CLOSED state. 🙈
- If the T1-init timer expires, the endpoint MUST retransmit INIT and re-start the T1-init timer without changing state. This MUST be repeated up to 'Max.Init.Retransmits' times. After that, the endpoint MUST abort the initialization process and report the error to SCTP user. 😭
- If the T1-cookie timer expires, the endpoint MUST retransmit COOKIE ECHO and re-start the T1-cookie timer without changing state. This MUST be repeated up to 'Max.Init.Retransmits' times. After that, the endpoint MUST abort the initialization process and report the error to SCTP user. 💀
- In SHUTDOWN-SENT state the endpoint MUST acknowledge any received DATA chunks without delay. ⭐
- In SHUTDOWN-RECEIVED state, the endpoint MUST NOT accept any new send request from its SCTP user. 🫶
- In SHUTDOWN-RECEIVED state, the endpoint MUST transmit or retransmit data and leave this state when all data in queue is transmitted. 🔥
- In SHUTDOWN-ACK-SENT state, the endpoint MUST NOT accept any new send request from its SCTP user. 👑
The CLOSED state is used to indicate that an association is not created (i.e., doesn't exist). That's the "not me, not existing yet" vibe 🧚
5. Association Initialization 🎀
Before any data can be sent from one SCTP endpoint ("A") to another SCTP endpoint ("Z"), the two endpoints have to go through an initialization process to set up an SCTP association between them. No skipping the setup, it's giving prep before the main event 💜
The SCTP user at an endpoint should use the ASSOCIATE primitive to initialize an SCTP association to another SCTP endpoint 🍓
IMPLEMENTATION NOTE: From an SCTP-user's point of view, an association may be implicitly opened, without an ASSOCIATE primitive (see 10.1 B) being invoked, by the initiating endpoint's sending of the first user data to the destination endpoint. The initiating SCTP will assume default values for all mandatory and optional parameters for the INIT/INIT ACK. ✨
Once the association is established, unidirectional streams are open for data transfer on both ends (see Section 5.1.1). Literally the moment everyone's ready to talk 🦋
5.1 Normal Establishment of an Association 💖
okay so let's walk through how an association gets set up 🎀 we're pretending SCTP endpoint "A" wants to connect with SCTP endpoint "Z", and "Z" says yes to the new association 🫶
A) okay, first thing: "A" sends an INIT chunk to "Z" ✨ In the INIT, "A" must provide its Verification Tag (Tag_A) in the Initiate Tag field. Tag_A SHOULD be a random number in the range of 1 to 4294967295 (see 5.3.1 for Tag value selection). After sending the INIT, "A" starts the T1-init timer and enters the COOKIE-WAIT state. 🦋
B) "Z" shall respond immediately with an INIT ACK chunk 💅 The destination IP address of the INIT ACK MUST be set to the source IP address of the INIT that this INIT ACK is responding to. In the response, along with filling in other parameters, "Z" must set the Verification Tag field to Tag_A, and also provide its own Verification Tag (Tag_Z) in the Initiate Tag field.
Moreover, "Z" MUST generate and send along with the INIT ACK a State Cookie 🍓 See Section 5.1.3 for State Cookie generation.
Note: After sending out INIT ACK with the State Cookie parameter, "Z" MUST NOT allocate any resources, nor keep any states for the new association. Otherwise, "Z" will be vulnerable to resource attacks. 💀 this one is serious bestie, don't skip it
C) Once "A" gets the INIT ACK from "Z", "A" shall stop the T1-init timer and leave COOKIE-WAIT state 🌸 Then "A" shall send the State Cookie it got in the INIT ACK chunk inside a COOKIE ECHO chunk, start the T1-cookie timer, and enter the COOKIE-ECHOED state.
Note: The COOKIE ECHO chunk can be bundled with any pending outbound DATA chunks, but it MUST be the first chunk in the packet, and until the COOKIE ACK is returned the sender MUST NOT send any other packets to the peer. 🙈
D) When "Z" receives the COOKIE ECHO chunk, Endpoint "Z" replies with a COOKIE ACK chunk after building a TCB and moving to the ESTABLISHED state 🎉 A COOKIE ACK chunk may be bundled with any pending DATA chunks (and/or SACK chunks), but the COOKIE ACK chunk MUST be the first chunk in the packet.
IMPLEMENTATION NOTE: An implementation may choose to send the Communication Up notification to the SCTP user upon reception of a valid COOKIE ECHO chunk. ✨
E) When "A" gets the COOKIE ACK, endpoint "A" moves from the COOKIE-ECHOED state to the ESTABLISHED state, and stops the T1-cookie timer 👑 It may also tell its ULP about the successful establishment of the association with a Communication Up notification (see Section 10).
An INIT or INIT ACK chunk MUST NOT be bundled with any other chunk. They MUST be the only chunks present in the SCTP packets that carry them. 🫶
An endpoint MUST send the INIT ACK to the IP address the INIT came from.
Note: T1-init timer and T1-cookie timer shall follow the same rules given in Section 6.3. ⏱️
If an endpoint gets an INIT, INIT ACK, or COOKIE ECHO chunk but decides not to establish the new association, because of missing mandatory parameters in the received INIT or INIT ACK, invalid parameter values, or a lack of local resources, it MUST respond with an ABORT chunk 😭 It SHOULD also say what caused the abort, like which mandatory parameters were missing, by including error cause parameters with the ABORT chunk. The Verification Tag field in the common header of the outbound SCTP packet that carries the ABORT chunk MUST be set to the Initiate Tag value of the peer. 🥀
After the first DATA chunk arrives in an association, the endpoint MUST immediately respond with a SACK to acknowledge the DATA chunk ✅ Later acknowledgements should be done as described in Section 6.2.
When the TCB is created, each endpoint MUST set its internal Cumulative TSN Ack Point to its transmitted Initial TSN minus one 🧮
IMPLEMENTATION NOTE: The IP addresses and SCTP port are generally used as the key to find the TCB within an SCTP instance. 🔑
5.1.1 Handle Stream Parameters 🌊
In the INIT and INIT ACK chunks, the sender of the chunk shall indicate the number of outbound streams (OS) it wants in the association, plus the maximum inbound streams (MIS) it will accept from the other endpoint 💫
After getting the stream configuration info from the other side, each endpoint shall do this check: if the peer's MIS is less than the endpoint's OS, meaning the peer can't support all the outbound streams the endpoint wants to configure, the endpoint MUST either use MIS outbound streams, or abort the association and report the resource shortage at its peer to its upper layer 🙅♀️
After the association is initialized, the valid outbound stream identifier range for either endpoint shall be 0 to min(local OS, remote MIS)-1. 🎀
5.1.2 Handle Address Parameters 📍
During association initialization, an endpoint shall use the following rules to discover and collect the destination transport address(es) of its peer 🕵️♀️
A) If there are no address parameters in the received INIT or INIT ACK chunk, the endpoint shall take the source IP address the chunk arrived from and record it, together with the SCTP source port number, as the only destination transport address for this peer. 💖
B) If there is a Host Name parameter in the received INIT or INIT ACK chunk, the endpoint shall resolve that host name to a list of IP address(es) and derive the transport address(es) of this peer by combining the resolved IP address(es) with the SCTP source port 🌐
The endpoint MUST ignore any other IP address parameters if they are also present in the received INIT or INIT ACK chunk. 🙄
The timing of host name resolution has potential security implications for SCTP, so pay attention here 🚨 If the receiver of an INIT resolves the host name when the chunk arrives, and the mechanism it uses for resolution involves potential long delay (e.g. a DNS query), the receiver may open itself up to resource attacks for the time it spends waiting on the name resolution results before it can build the State Cookie and release local resources.
So, in cases where the name translation involves potential long delay, the receiver of the INIT MUST postpone the name resolution until the COOKIE ECHO chunk arrives from the peer 🧊 In that case, the receiver of the INIT SHOULD build the State Cookie using the received Host Name (instead of destination transport addresses), and send the INIT ACK to the source IP address the INIT came from.
The receiver of an INIT ACK shall always attempt name resolution immediately when the chunk arrives ⚡
The receiver of the INIT or INIT ACK MUST NOT send user data (piggy-backed or stand-alone) to its peer until the host name has been successfully resolved. 🛑
If the name resolution is not successful, the endpoint MUST immediately send an ABORT with an "Unresolvable Address" error cause to its peer 😤 The ABORT shall be sent to the source IP address the last peer packet was received from.
C) If only IPv4/IPv6 addresses are present in the received INIT or INIT ACK chunk, the receiver shall derive and record all the transport address(es) from the received chunk AND the source IP address that sent the INIT or INIT ACK 🧭 The transport address(es) are derived by combining the SCTP source port (from the common header), the IP address parameter(s) carried in the INIT or INIT ACK chunk, and the source IP address of the IP datagram. The receiver should use only these transport addresses as destination transport addresses when sending later packets to its peer. 🎯
IMPLEMENTATION NOTE: In some cases (for example, when the implementation doesn't control the source IP address used for transmitting), an endpoint might need to include in its INIT or INIT ACK every possible IP address that packets to the peer could be sent from. 🌈
After all transport addresses are derived from the INIT or INIT ACK chunk using the rules above, the endpoint shall select one of the transport addresses as the initial primary path 🛤️
Note: The INIT-ACK MUST be sent to the source address of the INIT. 📬
The sender of INIT may include a 'Supported Address Types' parameter in the INIT to say which address types are acceptable 🗂️ When this parameter is present, the receiver of the INIT (initiatee) MUST either use one of the address types indicated in the Supported Address Types parameter when responding to the INIT, or abort the association with an "Unresolvable Address" error cause if it is unwilling or unable to use any of the address types its peer indicated. 🙋♀️
IMPLEMENTATION NOTE: If the receiver of an INIT ACK fails to resolve the address parameter because of an unsupported type, it can abort the initiation process and then try re-initiation, using a 'Supported Address Types' parameter in the new INIT to say which address types it prefers. 🔁
5.1.3 Generating State Cookie 🍪
When sending an INIT ACK in response to an INIT chunk, the sender of the INIT ACK creates a State Cookie and sends it in the State Cookie parameter of the INIT ACK 🧁 Inside this State Cookie, the sender should include a MAC (see [RFC2104] for an example), a time stamp of when the State Cookie was created, and the lifespan of the State Cookie, along with all the information needed to establish the association 💜
The following steps SHOULD be taken to generate the State Cookie:
- Create an association TCB using information from both the received INIT and the outgoing INIT ACK chunk.
- In the TCB, set the creation time to the current time of day, and the lifespan to the protocol parameter 'Valid.Cookie.Life'.
- From the TCB, identify and collect the minimal subset of information needed to re-create the TCB, and generate a MAC using this subset of information and a secret key (see [RFC2104] for an example of generating a MAC).
- Generate the State Cookie by combining this subset of information and the resultant MAC.
After sending the INIT ACK with the State Cookie parameter, the sender SHOULD delete the TCB and any other local resource related to the new association, so as to prevent resource attacks 🛡️
The hashing method used to generate the MAC is strictly a private matter for the receiver of the INIT chunk. The use of a MAC is mandatory to prevent denial of service attacks 🚫 The secret key SHOULD be random ([RFC1750] provides some information on randomness guidelines). It SHOULD be changed reasonably frequently, and the timestamp in the State Cookie MAY be used to determine which key should be used to verify the MAC 🔐
An implementation SHOULD make the cookie as small as possible to insure interoperability. 🎀
5.1.4. State Cookie Processing 💖
Okay so, when an endpoint that's stuck in the COOKIE WAIT state gets an INIT ACK chunk with a State Cookie parameter, it MUST immediately send a COOKIE ECHO chunk back to its peer with that same State Cookie. The sender MAY also tack any pending DATA chunks onto the packet right after the COOKIE ECHO 🎀
The endpoint shall also start the T1-cookie timer once the COOKIE ECHO is out. If that timer goes off, the endpoint shall resend the COOKIE ECHO and restart the T1-cookie timer. This keeps happening until either a COOKIE ACK comes back or ' Max.Init.Retransmits' is reached, and then the peer gets marked unreachable (so the association moves into the CLOSED state) 💀
5.1.5. State Cookie Authentication 🔐
When an endpoint gets a COOKIE ECHO chunk from another endpoint it has no association with, it shall do the following:
- Compute a MAC using the TCB data carried in the State Cookie and the secret key. (Quick note: the timestamp in the State Cookie MAY be used to figure out which secret key to use.) [RFC2104] can be used as a guideline for generating the MAC. 🧁
- Authenticate the State Cookie as one it previously generated by comparing the computed MAC against the one carried in the State Cookie. If this comparison fails, the SCTP packet, including the COOKIE ECHO and any DATA chunks, should be silently discarded. 🙈
- Compare the creation timestamp in the State Cookie to the current local time. If the elapsed time is longer than the lifespan carried in the State Cookie, then the packet, including the COOKIE ECHO and any attached DATA chunks, SHOULD be discarded and the endpoint MUST transmit an ERROR chunk with a "Stale Cookie" error cause to the peer endpoint. 🍓
- If the State Cookie is valid, create an association to the sender of the COOKIE ECHO chunk using the information in the TCB data carried in the COOKIE ECHO, and enter the ESTABLISHED state. ✨
- Send a COOKIE ACK chunk to the peer to acknowledge that the COOKIE ECHO was received. The COOKIE ACK MAY be bundled with an outbound DATA chunk or SACK chunk; however, the COOKIE ACK MUST be the first chunk in the SCTP packet. 🫶
- Immediately acknowledge any DATA chunk bundled with the COOKIE ECHO with a SACK (subsequent DATA chunk acknowledgement should follow the rules defined in Section 6.2). As mentioned in step 5, if the SACK is bundled with the COOKIE ACK, the COOKIE ACK MUST appear first in the SCTP packet. 👑
If a COOKIE ECHO comes from an endpoint that the receiver of the COOKIE ECHO already has an existing association with, the procedures in Section 5.2 should be followed. 🌸
5.1.6. An Example of Normal Association Establishment 🦋
Here's the example. "A" starts the association, then sends a user message to "Z". Later, "Z" sends two user messages back to "A". (This assumes no bundling or fragmentation happens.) 🧚
Endpoint A Endpoint Z
{app sets association with Z}
(build TCB)
INIT [I-Tag=Tag_A
& other info] --------\
(Start T1-init timer) \
(Enter COOKIE-WAIT state) \---> (compose temp TCB and Cookie_Z)
/--- INIT ACK [Veri Tag=Tag_A,
/ I-Tag=Tag_Z,
(Cancel T1-init timer) <------/ Cookie_Z, & other info]
(destroy temp TCB)
COOKIE ECHO [Cookie_Z] ------\
(Start T1-init timer) \
(Enter COOKIE-ECHOED state) \---> (build TCB enter ESTABLISHED
state)
/---- COOKIE-ACK
/
(Cancel T1-init timer, <-----/
Enter ESTABLISHED state)
{app sends 1st user data; strm 0}
DATA [TSN=initial TSN_A
Strm=0,Seq=1 & user data]--\
(Start T3-rtx timer) \
\->
/----- SACK [TSN Ack=init
TSN_A,Block=0]
(Cancel T3-rtx timer) <------/
...
{app sends 2 messages;strm 0}
/---- DATA
/ [TSN=init TSN_Z
<--/ Strm=0,Seq=1 & user data 1]
SACK [TSN Ack=init TSN_Z, /---- DATA
Block=0] --------\ / [TSN=init TSN_Z +1,
\/ Strm=0,Seq=2 & user data 2]
<------/\
\
\------>Figure 4: INITiation Example
If the T1-init timer expires at "A" after the INIT or COOKIE ECHO chunks are sent, the same INIT or COOKIE ECHO chunk, with the same Initiate Tag (i.e., Tag_A) or State Cookie, shall be retransmitted and the timer restarted. This shall be repeated Max.Init.Retransmits times before "A" considers "Z" unreachable and reports the failure to its upper layer (and thus the association enters the CLOSED state). When retransmitting the INIT, the endpoint MUST follow the rules defined in 6.3 to determine the proper timer value. ⏰
5.2. Handle Duplicate or Unexpected INIT, INIT ACK, COOKIE ECHO, and COOKIE ACK 🌈
During the lifetime of an association (in any of its possible states), an endpoint may receive one of the setup chunks (INIT, INIT ACK, COOKIE ECHO, and COOKIE ACK) from its peer endpoint. The receiver shall treat that setup chunk as a duplicate and process it the way this section describes. 🔁
Note: An endpoint will not receive the chunk unless the chunk was sent to a SCTP transport address and is from a SCTP transport address associated with this endpoint. So the endpoint processes that chunk as part of its current association. 📌
These scenarios can cause duplicated or unexpected chunks:
A) The peer has crashed without being detected, restarted itself, and sent out a new INIT chunk trying to restore the association. 💻
B) Both sides are trying to initialize the association at about the same time. 🤝
C) The chunk is from a stale packet that was used to establish the present association, or from a past association that no longer exists. 🕰️
D) The chunk is a false packet generated by an attacker. 😈
E) The peer never received the COOKIE ACK and is retransmitting its COOKIE ECHO. 🔄
The rules in the following sections shall be applied in order to identify and correctly handle these cases. 📋
5.2.1. INIT received in COOKIE-WAIT or COOKIE-ECHOED State (Item B) 🥊
This usually means there's an initialization collision, i.e., each endpoint is trying, at about the same time, to set up an association with the other endpoint. 💥
When an endpoint in the COOKIE-WAIT or COOKIE-ECHOED state gets an INIT, it MUST respond with an INIT ACK using the same parameters it sent in its original INIT chunk (including its Initiation Tag, unchanged). Those original parameters are combined with the ones from the newly received INIT chunk. The endpoint shall also generate a State Cookie with the INIT ACK. The endpoint uses the parameters it sent in its INIT to calculate the State Cookie. 🍪
After that, the endpoint MUST NOT change its state, the T1-init timer shall be left running, and the corresponding TCB MUST NOT be destroyed. The normal procedures for handling State Cookies when a TCB exists will resolve the duplicate INITs into a single association. 🎯
An endpoint in the COOKIE-ECHOED state MUST populate its Tie-Tags with the Tag information of itself and its peer (see section 5.2.2 for a description of the Tie-Tags). 🏷️
5.2.2. Unexpected INIT in States Other than CLOSED, COOKIE-ECHOED, COOKIE-WAIT and SHUTDOWN-ACK-SENT 🚫
Unless otherwise stated, when an unexpected INIT for this association is received, the endpoint shall generate an INIT ACK with a State Cookie. In the outbound INIT ACK, the endpoint MUST copy its current Verification Tag and the peer's Verification Tag into a reserved place within the state cookie. We refer to these locations as the Peer's-Tie-Tag and the Local-Tie-Tag. The outbound SCTP packet containing this INIT ACK MUST carry a Verification Tag value equal to the Initiation Tag found in the unexpected INIT. And the INIT ACK MUST contain a new Initiation Tag (randomly generated, see Section 5.3.1). Other parameters for the endpoint SHOULD be copied from the existing parameters of the association (e.g., number of outbound streams) into the INIT ACK and cookie. 🎀
After sending the INIT ACK, the endpoint shall take no further actions. That means the existing association, including its current state, and the corresponding TCB MUST NOT be changed. ✋
Note: Only when a TCB exists and the association is not in a COOKIE-WAIT state are the Tie-Tags populated. For a normal association INIT (i.e., the endpoint is in a COOKIE-WAIT state), the Tie-Tags MUST be set to 0 (indicating that no previous TCB existed). The INIT ACK and State Cookie are populated as specified in section 5.2.1. 📝
5.2.3. Unexpected INIT ACK 🙅
If an INIT ACK is received by an endpoint in any state other than COOKIE-WAIT, the endpoint should discard the INIT ACK chunk. An unexpected INIT ACK usually means an old or duplicated INIT chunk is being processed. 🗑️
5.2.4. Handle a COOKIE ECHO when a TCB exists 🧩
When a COOKIE ECHO chunk is received by an endpoint in any state for an existing association (i.e., not in the CLOSED state), the following rules shall be applied:
- Compute a MAC as described in Step 1 of Section 5.1.5.
- Authenticate the State Cookie as described in Step 2 of Section 5.1.5 (this is case C or D above).
- Compare the timestamp in the State Cookie to the current time. If the State Cookie is older than the lifespan carried in the State Cookie and the Verification Tags contained in the State Cookie do not match the current association's Verification Tags, the packet, including the COOKIE ECHO and any DATA chunks, should be discarded. The endpoint also MUST transmit an ERROR chunk with a "Stale Cookie" error cause to the peer endpoint (this is case C or D in section 5.2).
If both Verification Tags in the State Cookie match the Verification Tags of the current association, consider the State Cookie valid (this is case E of section 5.2) even if the lifespan is exceeded. 🍭
- If the State Cookie proves to be valid, unpack the TCB into a temporary TCB. 📦
- Refer to Table 2 to determine the correct action to be taken. 🗂️
+------------+------------+---------------+--------------+-------------+
| Local Tag | Peer's Tag | Local-Tie-Tag |Peer's-Tie-Tag| Action/ |
| | | | | Description |
+------------+------------+---------------+--------------+-------------+
| X | X | M | M | (A) |
+------------+------------+---------------+--------------+-------------+
| M | X | A | A | (B) |
+------------+------------+---------------+--------------+-------------+
| M | 0 | A | A | (B) |
+------------+------------+---------------+--------------+-------------+
| X | M | 0 | 0 | (C) |okay bestie, this table is the decision chart for when a COOKIE ECHO shows up and a TCB already exists 💅
+------------+------------+---------------+--------------+-------------+
| M | M | A | A | (D) |
+======================================================================+
| Table 2: Handling of a COOKIE ECHO when a TCB exists |
+======================================================================+Legend:
- X: tag does not match the existing TCB 🙈
- M: tag matches the existing TCB 💖
- 0: no Tie-Tag in the Cookie (unknown) ❓
- A: all cases, so M, X or 0 🌈
Note: anything NOT shown in Table 2 gets its cookie silently discarded. Bye bye, no drama 🫶
A) Okay, this one is the peer may have restarted 🔄 When the endpoint spots that possible 'restart', the existing session gets treated the same as if it got an ABORT followed by a brand new COOKIE ECHO. There are two exceptions though:
- Any SCTP DATA Chunks MAY be retained (this part is up to the implementation, so it's a choice 🎀).
- A notification of RESTART SHOULD be sent to the ULP instead of a "COMMUNICATION LOST" notification 📣
All the congestion control parameters (e.g., cwnd, ssthresh) for this peer MUST be reset to their initial values (see Section 6.2.1) 🧹 After that, the endpoint shall enter the ESTABLISHED state ✨
Also, if the endpoint is in SHUTDOWN-ACK-SENT and it sees the peer restarted (that's Action A again), it MUST NOT set up a new association. Instead it resends the SHUTDOWN ACK and sends an ERROR chunk with a "Cookie Received while Shutting Down" error cause to its peer 🙅♀️
B) This one is giving two sides trying to start an association at about the same time 👯 The peer started its INIT after answering the local endpoint's INIT, so it might have picked a new Verification Tag without knowing about the tag it sent before. The endpoint should stay in or enter the ESTABLISHED state, but it MUST update its peer's Verification Tag from the State Cookie. It also has to stop any init or cookie timers that may be running and send a COOKIE ACK 🍓
C) Here the local endpoint's cookie showed up late, like fashionably late 🕰️ Before it arrived, the local endpoint sent an INIT, got an INIT-ACK, and finally sent a COOKIE ECHO with the peer's same tag but a new tag of its own. The cookie should be silently discarded. The endpoint SHOULD NOT change states and should leave any timers running ⏳
D) When both the local and remote tags match, the endpoint should always enter the ESTABLISHED state, if it hasn't already. It should stop any init or cookie timers that may be running and send a COOKIE ACK. Main character energy 👑
Note: the "peer's Verification Tag" is the tag received in the Initiate Tag field of the INIT or INIT ACK chunk 💜
5.2.4.1 An Example of a Association Restart
Okay, so in this example "A" starts the association after a restart. Endpoint "Z" didn't know about the restart until this exchange (the Heartbeats hadn't detected that "A" failed yet) 🧚 This assumes no bundling or fragmentation happens:
Endpoint A Endpoint Z
<-------------- Association is established---------------------->
Tag=Tag_A Tag=Tag_Z
<--------------------------------------------------------------->
{A crashes and restarts}
{app sets up a association with Z}
(build TCB)
INIT [I-Tag=Tag_A'
& other info] --------\
(Start T1-init timer) \
(Enter COOKIE-WAIT state) \---> (find a existing TCB
compose temp TCB and Cookie_Z
with Tie-Tags to previous
association)
/--- INIT ACK [Veri Tag=Tag_A',
/ I-Tag=Tag_Z',
(Cancel T1-init timer) <------/ Cookie_Z[TieTags=
Tag_A,Tag_Z
& other info]
(destroy temp TCB,leave original
in place)
COOKIE ECHO [Veri=Tag_Z',
Cookie_Z
Tie=Tag_A,
Tag_Z]----------\
(Start T1-init timer) \
(Enter COOKIE-ECHOED state) \---> (Find existing association,
Tie-Tags match old tags,
Tags do not match i.e.
case X X M M above,
Announce Restart to ULP
and reset association).
/---- COOKIE-ACK
/
(Cancel T1-init timer, <-----/
Enter ESTABLISHED state)
{app sends 1st user data; strm 0}
DATA [TSN=initial TSN_A
Strm=0,Seq=1 & user data]--\
(Start T3-rtx timer) \
\->
/----- SACK [TSN Ack=init TSN_A,Block=0]
(Cancel T3-rtx timer) <------/
Figure 5: A Restart Example5.2.5 Handle Duplicate COOKIE-ACK.
In any state other than COOKIE-ECHOED, an endpoint should silently discard a received COOKIE ACK chunk 🙈
5.2.6 Handle Stale COOKIE Error
Getting an ERROR chunk with a "Stale Cookie" error cause means one of a few things could have happened 🤔
A) The association didn't fully set up before the State Cookie from the sender got processed.
B) An old State Cookie got processed after setup was already done.
C) An old State Cookie came from someone the receiver doesn't want an association with, and the ABORT chunk got lost 😬
When an endpoint processes an ERROR chunk with a "Stale Cookie" error cause, it should first check whether an association is being set up, meaning it's in the COOKIE-ECHOED state. If the association is not in COOKIE-ECHOED, the ERROR chunk should be silently discarded 🫧
If the association IS in COOKIE-ECHOED, the endpoint may pick one of these three options:
- Send a new INIT chunk to the endpoint to generate a new State Cookie and try the setup again 🔁
- Discard the TCB and report to the upper layer that the association couldn't be set up 🙃
- Send a new INIT chunk to the endpoint with a Cookie Preservative parameter asking for the State Cookie's lifetime to be extended. When calculating that extension, an implementation SHOULD use the RTT measured from the previous COOKIE ECHO / ERROR exchange, and should add no more than 1 second on top of that measured RTT. Long State Cookie lifetimes make the endpoint more open to a replay attack, so keep it tight 🔐
5.3 Other Initialization Issues
5.3.1 Selection of Tag Value
Initiate Tag values should be selected from the range of 1 to 2**32 - 1. The Initiate Tag value must be randomized, and this is SO important, because it helps protect against "man in the middle" and "sequence number" attacks 🕵️♀️ The methods described in [RFC1750] can be used for the Initiate Tag randomization. Picking Initiate Tags carefully also matters, because it stops old duplicate packets from previous associations from being mistakenly processed as part of the current association 🦋
Also, the Verification Tag value that either endpoint uses in a given association MUST NOT change during the lifetime of that association 🔒 A new Verification Tag value MUST be used each time the endpoint tears down and then re-establishes an association to the same peer. Fresh start, new tag, iconic 💅
6. User Data Transfer ✨
Data transmission MUST only happen in the ESTABLISHED, SHUTDOWN-PENDING, and SHUTDOWN-RECEIVED states. The only exception is that DATA chunks are allowed to be bundled with an outbound COOKIE ECHO chunk when in COOKIE-WAIT state 🍓
DATA chunks MUST only be received according to the rules below in ESTABLISHED, SHUTDOWN-PENDING, SHUTDOWN-SENT. A DATA chunk received in CLOSED is out of the blue and SHOULD be handled per 8.4. A DATA chunk received in any other state SHOULD be discarded 🚫
A SACK MUST be processed in ESTABLISHED, SHUTDOWN-PENDING, and SHUTDOWN-RECEIVED. An incoming SACK MAY be processed in COOKIE-ECHOED. A SACK in the CLOSED state is out of the blue and SHOULD be processed according to the rules in 8.4. A SACK chunk received in any other state SHOULD be discarded 🧾
A SCTP receiver MUST be able to receive a minimum of 1500 bytes in one SCTP packet. This means that a SCTP endpoint MUST NOT indicate less than 1500 bytes in its Initial a_rwnd sent in the INIT or INIT ACK 📦
For transmission efficiency, SCTP defines mechanisms for bundling small user messages and fragmenting large ones 🧩 The diagram below shows how user messages flow through SCTP:
+--------------------------+
| User Messages |
+--------------------------+
SCTP user ^ |
==================|==|=======================================
| v (1)
+------------------+ +--------------------+
| SCTP DATA Chunks | |SCTP Control Chunks |
+------------------+ +--------------------+
^ | ^ |
| v (2) | v (2)
+--------------------------+
| SCTP packets |
+--------------------------+
SCTP ^ |
===========================|==|===========================
| v
Connectionless Packet Transfer Service (e.g., IP)In this section, the term "data sender" refers to the endpoint that transmits a DATA chunk, and the term "data receiver" refers to the endpoint that receives a DATA chunk. A data receiver will transmit SACK chunks 💌
Notes:
- When converting user messages into DATA chunks, an endpoint will fragment user messages larger than the current association path MTU into multiple DATA chunks. The data receiver will normally reassemble the fragmented message from DATA chunks before delivery to the user (see Section 6.9 for details) 🧃
- Multiple DATA and control chunks may be bundled by the sender into a single SCTP packet for transmission, as long as the final size of the packet does not exceed the current path MTU. The receiver will unbundle the packet back into the original chunks. Control chunks MUST come before DATA chunks in the packet 🌸
Figure 6: Illustration of User Data TransferThe fragmentation and bundling mechanisms, as detailed in Sections 6.9 and 6.10, are OPTIONAL to implement by the data sender. They MUST be implemented by the data receiver, though, i.e., an endpoint MUST properly receive and process bundled or fragmented data. That's the rule, no cap 🫶
6.1. Transmission of DATA Chunks ✨
okay bestie, so this section is all about how the sender pushes out DATA chunks 🦋 the spec pretends there's a single retransmission timer per destination transport address, but implementations MAY have a retransmission timer for each DATA chunk 💖
these general rules MUST be applied by the data sender for transmission and/or retransmission of outbound DATA chunks 🎀
A) at any given time, the data sender MUST NOT transmit new data to any destination transport address if its peer's rwnd says the peer has no buffer space (aka rwnd is 0, see Section 6.2.1) 🙈 BUT, regardless of rwnd (even if it's 0), the data sender can always have one DATA chunk in flight to the receiver if cwnd allows it (see rule B below). this lets the sender poke at things and check for a change in rwnd it missed because the SACK got lost on the way back from the data receiver. main character probing energy 💅
B) at any given time, the sender MUST NOT transmit new data to a given transport address if it already has cwnd or more bytes of data outstanding to that address 🧚
C) when it's time to transmit, before sending any new DATA chunks, the sender MUST first transmit any outstanding DATA chunks that are marked for retransmission (limited by the current cwnd) 🌸
D) then the sender can send out as many new DATA chunks as Rule A and Rule B above allow ✨
multiple DATA chunks committed for transmission MAY be bundled in a single packet 🍓 and DATA chunks being retransmitted MAY be bundled with new DATA chunks too, as long as the resulting packet size does not exceed the path MTU 🫶 a ULP may request that no bundling happens, but this should only turn off any delays an SCTP implementation might be using to boost bundling efficiency. it does not, by itself, stop all bundling (like when there's congestion or retransmission) 🔥
before an endpoint transmits a DATA chunk, if any received DATA chunks haven't been acknowledged yet (e.g., because of delayed ack), the sender should create a SACK and bundle it with the outbound DATA chunk, as long as the final SCTP packet size doesn't exceed the current MTU. see Section 6.2 💜
IMPLEMENTATION NOTE: when the window is full (aka transmission is disallowed by Rule A and/or Rule B), the sender MAY still accept send requests from its upper layer 🌈 but MUST transmit no more DATA chunks until some or all of the outstanding DATA chunks are acknowledged and transmission is allowed by Rule A and Rule B again 💀
whenever a transmission or retransmission goes to any address, if the T3-rtx timer for that address isn't running, the sender MUST start that timer 🦋 if the timer for that address is already running, the sender MUST restart it only if the earliest outstanding DATA chunk sent to that address (the lowest TSN) is the one being retransmitted. otherwise, the data sender MUST NOT restart the timer 🙈
when starting or restarting the T3-rtx timer, the timer value has to be adjusted according to the timer rules in Sections 6.3.2, and 6.3.3 ⭐
Note: the data sender SHOULD NOT use a TSN that is more than 2**31 - 1 above the beginning TSN of the current send window. big number, big rule 🔥
6.2. Acknowledgement on Reception of DATA Chunks ✨
okay now the receiving side 🫶 the SCTP endpoint MUST always acknowledge the reception of each valid DATA chunk. no ghosting allowed 👑
the guidelines on the delayed acknowledgement algorithm in Section 4.2 of [RFC2581] SHOULD be followed 🎀 specifically, an acknowledgement SHOULD be generated for at least every second packet (not every second DATA chunk) received, and SHOULD be generated within 200 ms of the arrival of any unacknowledged DATA chunk. sometimes it's actually helpful for an SCTP transmitter to be more conservative than these algorithms allow 🧚 but an SCTP transmitter MUST NOT be more aggressive than the following algorithms allow. don't be extra in the wrong direction 💅
an SCTP receiver MUST NOT generate more than one SACK for every incoming packet, except to update the offered window as the receiving application consumes new data 🍓
IMPLEMENTATION NOTE: the maximum delay for generating an acknowledgement can be configured by the SCTP administrator, either statically or dynamically, so it can match the timing needs of whatever protocol is being carried 🌸
an implementation MUST NOT let the maximum delay be configured to more than 500ms. in other words, an implementation MAY lower this value below 500ms but MUST NOT raise it above 500ms 🙈
acknowledgements MUST be sent in SACK chunks, unless shutdown was requested by the ULP. in that case an endpoint MAY send an acknowledgement in the SHUTDOWN chunk 🦋 a SACK chunk can acknowledge the reception of multiple DATA chunks at once. see Section 3.3.4 for the SACK chunk format. in particular, the SCTP endpoint MUST fill in the Cumulative TSN Ack field with the latest sequential TSN (of a valid DATA chunk) it has received. any received DATA chunks with a TSN greater than the value in the Cumulative TSN Ack field SHOULD also be reported in the Gap Ack Block fields 💖
Note: the SHUTDOWN chunk doesn't have Gap Ack Block fields 😭 so the endpoint should use a SACK instead of the SHUTDOWN chunk to acknowledge DATA chunks that arrived out of order.
when a packet arrives with duplicate DATA chunk(s) and no new DATA chunk(s), the endpoint MUST immediately send a SACK with no delay 🔥 if a packet arrives with duplicate DATA chunk(s) bundled with new DATA chunks, the endpoint MAY immediately send a SACK. usually duplicates show up when the original SACK got lost and the peer's RTO expired 🥺 the duplicate TSN number(s) SHOULD be reported in the SACK as duplicate ✨
when an endpoint gets a SACK, it MAY use the Duplicate TSN information to figure out whether SACK loss is happening. any further use of this data is for future study 🧚
the data receiver is in charge of maintaining its receive buffers 👑 and it SHOULD tell the data sender in a timely manner whenever its ability to receive data changes. how an implementation manages its receive buffers depends on lots of things (like the operating system, the memory management system, how much memory there is, and so on) 🌈 however, the data sender strategy defined in Section 6.2.1 assumes the receiver works roughly like this:
A) at association initialization, the endpoint tells the peer how much receive buffer space it has allocated to the association, in the INIT or INIT ACK. the endpoint sets a_rwnd to this value 🎀
B) as DATA chunks are received and buffered, decrement a_rwnd by the number of bytes received and buffered. this is basically closing rwnd at the data sender and limiting how much it can send 🙈
C) as DATA chunks get delivered to the ULP and released from the receive buffers, increment a_rwnd by the number of bytes delivered to the upper layer. this is basically opening rwnd back up so the sender can send more 🦋 the data receiver SHOULD NOT increment a_rwnd unless it has actually released bytes from its receive buffer. for example, if the receiver is holding fragmented DATA chunks in a reassembly queue, it should not increment a_rwnd 💅
D) when sending a SACK, the data receiver SHOULD put the current value of a_rwnd into the a_rwnd field. the data receiver SHOULD also take into account that the data sender won't retransmit DATA chunks acked via the Cumulative TSN Ack (aka they get dropped from its retransmit queue) 🫶
sometimes the data receiver has to drop DATA chunks it received but hasn't released from its receive buffers yet (aka hasn't delivered to the ULP) 😭 those DATA chunks may have been acked in Gap Ack Blocks. for example, the data receiver might be holding data in its receive buffers while reassembling a fragmented user message from its peer, then run out of receive buffer space. it can drop those DATA chunks even though it already acknowledged them in Gap Ack Blocks. if a data receiver drops DATA chunks, it MUST NOT include them in Gap Ack Blocks in subsequent SACKs until they're received again via retransmission 🍓 also, the endpoint should take the dropped data into account when calculating its a_rwnd ✨
an endpoint SHOULD NOT revoke a SACK and discard data 🙈 only in extreme circumstances should an endpoint use this procedure (like being out of buffer space). the data receiver should keep in mind that dropping data that was acked in Gap Ack Blocks can lead to suboptimal retransmission strategies in the data sender, and therefore suboptimal performance 🥺
here's an example of delayed acknowledgements in action 🦋
Endpoint A Endpoint Z
{App sends 3 messages; strm 0}
DATA [TSN=7,Strm=0,Seq=3] ------------> (ack delayed)
(Start T3-rtx timer)
DATA [TSN=8,Strm=0,Seq=4] ------------> (send ack)
/------- SACK [TSN Ack=8,block=0]
(cancel T3-rtx timer) <-----/
DATA [TSN=9,Strm=0,Seq=5] ------------> (ack delayed)
(Start T3-rtx timer)
...
{App sends 1 message; strm 1}
(bundle SACK with DATA)
/----- SACK [TSN Ack=9,block=0] \
/ DATA [TSN=6,Strm=1,Seq=2]
(cancel T3-rtx timer) <------/ (Start T3-rtx timer)
(ack delayed)
(send ack)
SACK [TSN Ack=6,block=0] -------------> (cancel T3-rtx timer)
Figure 7: Delayed Acknowledgment Exampleif an endpoint receives a DATA chunk with no user data (i.e., the Length field is set to 16), it MUST send an ABORT with the error cause set to "No User Data" 🚨 yikes, nobody wants that one 💀
an endpoint SHOULD NOT send a DATA chunk with no user data part 💅✨
6.2.1. Processing a Received SACK 💌
okay bestie, every SACK an endpoint gets carries an a_rwnd value 🫶 that tells you how much buffer space the data receiver has left at the moment it sends the SACK, out of its total receive buffer (the one set up in the INIT/INIT ACK). Put a_rwnd together with the Cumulative TSN Ack and the Gap Ack Blocks and the data sender can build a picture of the peer's receive buffer space 🦋
the tricky part is that SACKs can arrive out of order 😭 a SACK sent later by the data receiver can overtake an earlier one and show up first. when that happens, the data sender can end up with a wrong idea of the peer's receive buffer.
there's no explicit identifier that tells you a SACK is out of order, so the data sender has to use heuristics to figure out whether a SACK is new. it's giving detective energy 🕵️♀️
An endpoint SHOULD use the following rules to calculate the rwnd, using the a_rwnd value, the Cumulative TSN Ack and Gap Ack Blocks in a received SACK. 💅
- A) At the establishment of the association, the endpoint initializes the rwnd to the Advertised Receiver Window Credit (
a_rwnd) the peer specified in the INIT or INIT ACK. 🌸 - B) Any time a DATA chunk is transmitted (or retransmitted) to a peer, the endpoint subtracts the data size of the chunk from the rwnd of that peer. 🍓
- C) Any time a DATA chunk is marked for retransmission (via either T3-rtx timer expiration (Section 6.3.3) or via fast retransmit (Section 7.2.4)), add the data size of those chunks to the rwnd.
- Note: If the implementation is maintaining a timer on each DATA chunk then only DATA chunks whose timer expired would be marked for retransmission. ✨
- D) Any time a SACK arrives, the endpoint performs the following: 👑
- i) If Cumulative TSN Ack is less than the Cumulative TSN Ack Point, then drop the SACK. Since Cumulative TSN Ack is monotonically increasing, a SACK whose Cumulative TSN Ack is less than the Cumulative TSN Ack Point indicates an out-of-order SACK. 🙈
- ii) Set rwnd equal to the newly received
a_rwndminus the number of bytes still outstanding after processing the Cumulative TSN Ack and the Gap Ack Blocks. 🧚 - iii) If the SACK is missing a TSN that was previously acknowledged via a Gap Ack Block (e.g., the data receiver reneged on the data), then mark the corresponding DATA chunk as available for retransmit: Mark it as missing for fast retransmit as described in Section 7.2.4 and if no retransmit timer is running for the destination address to which the DATA chunk was originally transmitted, then T3-rtx is started for that destination address. 🔥
6.3. Management of Retransmission Timer ⏰
okay so an SCTP endpoint uses a retransmission timer called T3-rtx 🫶 to make sure data gets delivered even when the peer hasn't said anything back. the length of that timer is called the RTO (retransmission timeout) 💖
if the peer is multi-homed, the endpoint works out a separate RTO for each destination transport address the peer has 🦋
and the way SCTP handles RTO is lowkey copying how TCP manages its retransmission timer ✨ to compute the current RTO, each endpoint keeps two state variables per destination transport address: SRTT (smoothed round-trip time) and RTTVAR (round-trip time variation) 💜
6.3.1. RTO Calculation 🧮
these are the rules for computing SRTT, RTTVAR and RTO 👑
- C1) Until an RTT measurement has been made for a packet sent to the given destination transport address, set RTO to the protocol parameter 'RTO.Initial'. 🌸
- C2) When the first RTT measurement R is made, set
SRTT <- R,RTTVAR <- R/2, andRTO <- SRTT + 4 * RTTVAR. 🍓 - C3) When a new RTT measurement R' is made, set
RTTVAR <- (1 - RTO.Beta) * RTTVAR + RTO.Beta * |SRTT - R'|
SRTT <- (1 - RTO.Alpha) * SRTT + RTO.Alpha * R'- Note: The value of SRTT used in the update to RTTVAR is its value before updating SRTT itself using the second assignment. 🙈
After the computation, update RTO <- SRTT + 4 * RTTVAR. ✨
- C4) When data is in flight and when allowed by rule C5 below, a new RTT measurement MUST be made each round trip. Furthermore, new RTT measurements SHOULD be made no more than once per round-trip for a given destination transport address. There are two reasons for this recommendation: First, it appears that measuring more frequently often does not in practice yield any significant benefit [ALLMAN99]; second, if measurements are made more often, then the values of RTO.Alpha and RTO.Beta in rule C3 above should be adjusted so that SRTT and RTTVAR still adjust to changes at roughly the same rate (in terms of how many round trips it takes them to reflect new values) as they would if making only one measurement per round-trip and using RTO.Alpha and RTO.Beta as given in rule C3. However, the exact nature of these adjustments remains a research issue. 🔬
- C5) Karn's algorithm: RTT measurements MUST NOT be made using packets that were retransmitted (and thus for which it is ambiguous whether the reply was for the first instance of the packet or a later instance). 🚫
- C6) Whenever RTO is computed, if it is less than RTO.Min seconds then it is rounded up to RTO.Min seconds. The reason for this rule is that RTOs that do not have a high minimum value are susceptible to unnecessary timeouts [ALLMAN99]. 🫶
- C7) A maximum value may be placed on RTO provided it is at least RTO.max seconds. 🌈
There is no requirement for the clock granularity G used for computing RTT measurements and the different state variables, other than: 🕰️
- G1) Whenever RTTVAR is computed, if RTTVAR = 0, then adjust
RTTVAR <- G. 💅
Experience [ALLMAN99] has shown that finer clock granularities (<= 100 msec) perform somewhat better than more coarse granularities. ⭐
6.3.2. Retransmission Timer Rules ⏱️
the rules for managing the retransmission timer are as follows 🎀
- R1) Every time a DATA chunk is sent to any address (including a retransmission), if the T3-rtx timer of that address is not running, start it running so that it will expire after the RTO of that address. The RTO used here is that obtained after any doubling due to previous T3-rtx timer expirations on the corresponding destination address as discussed in rule E2 below. 🦋
- R2) Whenever all outstanding data sent to an address have been acknowledged, turn off the T3-rtx timer of that address. 🌸
- R3) Whenever a SACK is received that acknowledges the DATA chunk with the earliest outstanding TSN for that address, restart T3-rtx timer for that address with its current RTO (if there is still outstanding data on that address). 🔥
- R4) Whenever a SACK is received missing a TSN that was previously acknowledged via a Gap Ack Block, start T3-rtx for the destination address to which the DATA chunk was originally transmitted if it is not already running. 🧚
The following example shows the use of various timer rules (assuming the receiver uses delayed acks). Picture it as a little group chat between Endpoint A and Endpoint Z 📱💬
Endpoint A Endpoint Z
{App begins to send}
Data [TSN=7,Strm=0,Seq=3] ------------> (ack delayed)
(Start T3-rtx timer)
{App sends 1 message; strm 1}
(bundle ack with data)
DATA [TSN=8,Strm=0,Seq=4] ----\ /-- SACK [TSN Ack=7,Block=0]
\ / DATA [TSN=6,Strm=1,Seq=2]
\ / (Start T3-rtx timer)
\
/ \
(Re-start T3-rtx timer) <------/ \--> (ack delayed)
(ack delayed)
{send ack}
SACK [TSN Ack=6,Block=0] --------------> (Cancel T3-rtx timer)
..
(send ack)
(Cancel T3-rtx timer) <-------------- SACK [TSN Ack=8,Block=0]
Figure 8 - Timer Rule Examples6.3.3. Handle T3-rtx Expiration 🚨
whenever the retransmission timer T3-rtx expires for a destination address, do the following 💖
- E1) For the destination address for which the timer expires, adjust its ssthresh with rules defined in Section 7.2.3 and set the
cwnd <- MTU. 🌷 - E2) For the destination address for which the timer expires, set
RTO <- RTO * 2("back off the timer"). The maximum value discussed in rule C7 above (RTO.max) may be used to provide an upper bound to this doubling operation. 🍑 - E3) Determine how many of the earliest (i.e., lowest TSN) outstanding DATA chunks for the address for which the T3-rtx has expired will fit into a single packet, subject to the MTU constraint for the path corresponding to the destination transport address to which the retransmission is being sent (this may be different from the address for which the timer expires [see Section 6.4]). Call this value K. Bundle and retransmit those K DATA chunks in a single packet to the destination endpoint. 📦
- E4) Start the retransmission timer T3-rtx on the destination address to which the retransmission is sent, if rule R1 above indicates to do so. The RTO to be used for starting T3-rtx should be the one for the destination address to which the retransmission is sent, which, when the receiver is multi-homed, may be different from the destination address for which the timer expired (see Section 6.4 below). 🧁
After retransmitting, once a new RTT measurement is obtained (which can happen only when new data has been sent and acknowledged, per rule C5, or for a measurement made from a HEARTBEAT [see Section 8.3]), the computation in rule C3 is performed, including the computation of RTO, which may result in "collapsing" RTO back down after it has been subject to doubling (rule E2). 🪄
- Note: Any DATA chunks that were sent to the address for which the T3-rtx timer expired but did not fit in one MTU (rule E3 above), should be marked for retransmission and sent as soon as cwnd allows (normally when a SACK arrives). 🌈
The final rule for managing the retransmission timer concerns failover (see Section 6.4.1): 🧳
- F1) Whenever an endpoint switches from the current destination transport address to a different one, the current retransmission timers are left running. As soon as the endpoint transmits a packet containing DATA chunk(s) to the new transport address, start the timer on that transport address, using the RTO value of the destination address to which the data is being sent, if rule R1 indicates to do so. 🦋
6.4 Multi-homed SCTP Endpoints 🌸
Okay bestie, an SCTP endpoint counts as multi-homed if it has more than one transport address that can be used as a destination address to reach it. Main character energy 👑
The ULP of an endpoint has to pick one of the multiple destination addresses of a multi-homed peer as the primary path (see Sections 5.1.2 and 10.1 for details). 💅
By default, an endpoint SHOULD always transmit to the primary path 🎀, unless the SCTP user explicitly specifies the destination transport address (and possibly source transport address) to use.
An endpoint SHOULD transmit reply chunks (e.g., SACK, HEARTBEAT ACK, etc.) to the same destination transport address that it received the DATA or control chunk from, the one it's replying to ✨. This rule should also be followed if the endpoint is bundling DATA chunks together with the reply chunk, so it's consistent no matter what 🫶
Now the tricky bit 🙈: when acknowledging multiple DATA chunks that came in from different source addresses in a single SACK, the SACK chunk may be sent to one of the destination transport addresses that the DATA or control chunks being acknowledged were received from. Flexible!
When a receiver gets a duplicate DATA chunk and sends a SACK to a multi-homed endpoint, it MAY be beneficial to vary the destination address and not use the source address of the DATA chunk 🦋. Why? Getting a duplicate from a multi-homed endpoint might mean the return path (the one in the source address of the DATA chunk) for the SACK is broken. Lowkey a clue 🔥
Also, when its peer is multi-homed, an endpoint SHOULD try to retransmit a chunk to an active destination transport address that is different from the last destination address the DATA chunk was sent to. Switch it up, babe 💜
Retransmissions don't affect the total outstanding data count 🧚. However, if the DATA chunk is retransmitted onto a different destination address, both the outstanding data counts on the new destination address and the old destination address the data chunk was last sent to shall be adjusted accordingly. So both sides get updated, no drama 💖
6.4.1 Failover from Inactive Destination Address 🦋
Some of the transport addresses of a multi-homed SCTP endpoint can go inactive, either because of certain error conditions (see Section 8.2) or because the SCTP user adjusted things 🥺
When there's outbound data to send and the primary path goes inactive (e.g., due to failures), or the SCTP user explicitly asks to send data to an inactive destination transport address, the SCTP endpoint should try to send the data to an alternate active destination transport address if one exists, before reporting an error to its ULP. Don't give up too fast, bestie 💪
When retransmitting data, if the endpoint is multi-homed, it should consider each source-destination address pair in its retransmission selection policy. When retransmitting, the endpoint should attempt to pick the most divergent source-destination pair from the original source-destination pair the packet was sent on. Think "different enough to be interesting" 💅
Note: Rules for picking the most divergent source-destination pair are an implementation decision and are not specified within this document. So it's up to each implementation to decide 🙈
6.5 Stream Identifier and Stream Sequence Number 🍓
Every DATA chunk MUST carry a valid stream identifier. No exceptions, periodt 💀 If an endpoint gets a DATA chunk with an invalid stream identifier, it shall acknowledge the DATA chunk following the normal procedure, immediately send an ERROR chunk with cause set to Invalid Stream Identifier (see Section 3.3.10), and discard the DATA chunk. The endpoint may bundle the ERROR chunk in the same packet as the SACK, as long as the ERROR comes after the SACK 🎀
The stream sequence number in all the streams shall start from 0 when the association is established ✨. Also, when the stream sequence number reaches the value 65535, the next stream sequence number shall be set to 0. It's a loop, bestie 🌈
6.6 Ordered and Unordered Delivery 🌸
Within a stream, an endpoint MUST deliver DATA chunks received with the U flag set to 0 to the upper layer in the order of their stream sequence number. This is the order-matters vibe 👑 If DATA chunks arrive out of order of their stream sequence number, the endpoint MUST hold the received DATA chunks from delivery to the ULP until they're re-ordered. Patience is a virtue 🫶
However, an SCTP endpoint can say that no ordered delivery is needed for a particular DATA chunk sent within the stream, by setting the U flag of that DATA chunk to 1 🦋
When an endpoint receives a DATA chunk with the U flag set to 1, it must bypass the ordering mechanism and immediately deliver the data to the upper layer (after reassembly, if the sender fragmented the user data) 🔥
This is an effective way to send "out-of-band" data in a given stream 💜 Also, a stream can act as an "unordered" stream if you just set the U flag to 1 in every DATA chunk sent through it. Iconic 💅
IMPLEMENTATION NOTE: When sending an unordered DATA chunk, an implementation may choose to place the DATA chunk in an outbound packet at the head of the outbound transmission queue, if possible. Implementers, you've got options 🧚
The Stream Sequence Number field in a DATA chunk with the U flag set to 1 has no significance 🙈. The sender can fill it with any arbitrary value, but the receiver MUST ignore the field. So don't read into it, bestie 💖
Note: When transmitting ordered and unordered data, an endpoint does not increment its Stream Sequence Number when it transmits a DATA chunk with the U flag set to 1 ✨
6.7 Report Gaps in Received DATA TSNs 🦋
When a new DATA chunk arrives, an endpoint shall check the continuity of the TSNs it has received. If the endpoint detects a gap in the received DATA chunk sequence, it SHOULD send a SACK with Gap Ack Blocks immediately 🚨 The data receiver keeps sending a SACK after receiving each SCTP packet that doesn't fill the gap. It's like a little reminder, over and over 🫶
Based on the Gap Ack Block from the received SACK, the endpoint can work out the missing DATA chunks and decide whether to retransmit them (see Section 6.2.1 for details) 🎀
Multiple gaps can be reported in one single SACK (see Section 3.3.4) 🌈
When its peer is multi-homed, the SCTP endpoint SHOULD always try to send the SACK to the same destination address the last DATA chunk came in from 💜
When a SACK arrives, the endpoint MUST remove all DATA chunks that the SACK's Cumulative TSN Ack has acknowledged from its transmit queue 🧹 The endpoint MUST also treat all the DATA chunks with TSNs not included in the Gap Ack Blocks reported by the SACK as "missing". The data sender MUST record the number of "missing" reports for each outstanding DATA chunk so it can make retransmission decisions. See Section 7.2.4 for details 💅
The following example shows how a SACK reports a gap, so you can see it in action 👀
Endpoint A Endpoint Z
{App sends 3 messages; strm 0}
DATA [TSN=6,Strm=0,Seq=2] ---------------> (ack delayed)
(Start T3-rtx timer)
DATA [TSN=7,Strm=0,Seq=3] --------> X (lost)
DATA [TSN=8,Strm=0,Seq=4] ---------------> (gap detected,
immediately send ack)
/----- SACK [TSN Ack=6,Block=1,
/ Strt=2,End=2]
<-----/
(remove 6 from out-queue,
and mark 7 as "1" missing report)
Figure 9 - Reporting a Gap using SACKThe maximum number of Gap Ack Blocks that a single SACK chunk can report is limited by the current path MTU. When a single SACK can't cover all the Gap Ack Blocks that need reporting because of the MTU limit, the endpoint MUST send only one SACK. That SACK reports the Gap Ack Blocks from the lowest to highest TSNs, within the size limit the MTU sets, and leaves the remaining highest TSN numbers unacknowledged. Sorry, higher TSNs, you'll have to wait your turn 🥹
6.8 Adler-32 Checksum Calculation 💖
When sending an SCTP packet, the endpoint MUST strengthen the data integrity of the transmission by including the Adler-32 checksum value calculated over the packet, as described below 🔐
After the packet is built (containing the SCTP common header and one or more control or DATA chunks), the transmitter shall:
- Fill in the proper Verification Tag in the SCTP common header and set the checksum field to all 0's.
- Calculate the Adler-32 checksum of the whole packet, including the SCTP common header and all the chunks. Refer to appendix B for details of the Adler-32 algorithm. And,
- Put the resultant value into the checksum field in the common header, and leave the rest of the bits unchanged. ✨
When an SCTP packet arrives, the receiver MUST first check the Adler-32 checksum:
- Store the received Adler-32 checksum value aside,
- Replace the 32 bits of the checksum field in the received SCTP packet with all '0's, and calculate an Adler-32 checksum value of the whole received packet. And,
- Verify that the calculated Adler-32 checksum is the same as the received Adler-32 checksum. If not, the receiver MUST treat the packet as an invalid SCTP packet. 🚫
The default procedure for handling invalid SCTP packets is to silently discard them 🫥
6.9 Fragmentation and Reassembly 💅
okay bestie, so fragmentation is where things get a little spicy 🌶️ An endpoint MAY support fragmentation when sending DATA chunks, but it MUST support reassembly when receiving them 🫶 If an endpoint does support fragmentation, it MUST fragment a user message whenever the size of that message would make the outbound SCTP packet bigger than the current MTU 📏 And if an implementation doesn't support fragmenting outbound user messages, the endpoint must return an error to its upper layer and must not try to send the message at all 😭
IMPLEMENTATION NOTE: In this error case, the Send primitive discussed in Section 10.1 would need to return an error to the upper layer. 🙈
If the peer is multi-homed, the endpoint shall choose a size no larger than the association Path MTU ✨ The association Path MTU is the smallest Path MTU across all of the destination addresses. It's giving "weakest link" energy 🔗
Note: Once a message is fragmented it cannot be re-fragmented. Instead, if the PMTU has been reduced, then IP fragmentation must be used. Please see Section 7.3 for details of PMTU discovery. 💀
When it's deciding whether to fragment, the SCTP implementation MUST take into account the SCTP packet header as well as the DATA chunk header(s) 🧚 It also MUST take into account the space needed for a SACK chunk if it's bundling a SACK chunk with the DATA chunk. Main character accounting, no cap 👑
Fragmentation happens in these steps, and they are very specific:
- The data sender MUST break the user message into a series of DATA chunks, so that each chunk plus SCTP overhead fits into an IP datagram that is smaller than or equal to the association Path MTU 🍓
- The transmitter MUST then assign, in sequence, a separate TSN to each of the DATA chunks in the series. The transmitter assigns the same SSN to each of the DATA chunks. If the user indicates that the user message is to be delivered using unordered delivery, then the U flag of each DATA chunk of the user message MUST be set to 1. 🎀
- The transmitter MUST also set the B/E bits of the first DATA chunk in the series to
'10', the B/E bits of the last DATA chunk in the series to'01', and the B/E bits of all other DATA chunks in the series to'00'. Iykyk that the B/E bits are how the receiver knows where a message starts and ends 🦋
On the receiving side, an endpoint MUST recognize fragmented DATA chunks by examining the B/E bits in each of the received DATA chunks, and it queues the fragmented DATA chunks up for re-assembly 🧚 Once the user message is reassembled, SCTP shall pass the re-assembled user message to the specific stream for possible re-ordering and final dispatching. Serving organized receiver energy 🗂️
Note: If the data receiver runs out of buffer space while it's still waiting for more fragments to finish re-assembling the message, it should dispatch part of its inbound message through a partial delivery API (see Section 10). That frees up some of its receive buffer space so the rest of the message can be received. Lowkey genius, honestly 🌸
6.10 Bundling 🎁
Bundling is literally just an endpoint putting multiple chunks into one outbound SCTP packet 📦 The total size of the resulting IP datagram, including the SCTP packet and IP headers, MUST be less than or equal to the current Path MTU. Keep it under the cap, bestie 🫣
If the peer endpoint is multi-homed, the sending endpoint shall choose a size no larger than the latest MTU of the current primary path 🛣️
When it's bundling control chunks with DATA chunks, an endpoint MUST place the control chunks first in the outbound SCTP packet. The transmitter MUST transmit DATA chunks within an SCTP packet in increasing order of TSN. Order matters, babe 💖
Note: Since control chunks must be placed first in a packet, and since DATA chunks must be transmitted before SHUTDOWN or SHUTDOWN ACK chunks, DATA chunks cannot be bundled with SHUTDOWN or SHUTDOWN ACK chunks. 🙅♀️
Partial chunks MUST NOT be placed in an SCTP packet. Absolutely not, we don't do half chunks here 💅
An endpoint MUST process received chunks in their order in the packet. The receiver uses the chunk length field to find the end of one chunk and the beginning of the next, and it takes into account the fact that all chunks end on a 4 byte boundary 📐 If the receiver detects a partial chunk, it MUST drop the chunk. Bye bye, partial chunk 👋
An endpoint MUST NOT bundle INIT, INIT ACK or SHUTDOWN COMPLETE with any other chunks. These three are giving "I need my own space" energy and they deserve it 🧚♀️
7. Congestion control 🌊
Congestion control is one of the basic functions in SCTP, and it's honestly so important 🥹 For some applications, it may be likely that adequate resources will be allocated to SCTP traffic so that time-critical data gets delivered promptly. So it would seem unlikely that transmissions run into severe congestion during normal operations. However, SCTP must operate under adverse conditions, which can come up when there are partial network failures or unexpected traffic surges 😰 In those situations, SCTP must follow correct congestion control steps to recover from congestion quickly, so the data gets delivered as soon as possible. And when there's no congestion, these preventive algorithms should show no impact on protocol performance. They just sit there being iconic in the background 💜
IMPLEMENTATION NOTE: As far as its specific performance requirements are met, an implementation is always allowed to adopt a more conservative congestion control algorithm than the one defined below. ✨
The congestion control algorithms used by SCTP are based on [RFC2581]. This section describes how the algorithms defined in RFC2581 are adapted for use in SCTP. We'll first list the differences in protocol design between TCP and SCTP, and then describe SCTP's congestion control scheme. The description uses the same terminology as TCP congestion control whenever that makes sense 📚
SCTP congestion control is always applied to the entire association, and not to individual streams. It's the whole vibe, not one stream at a time 🫶
7.1 SCTP Differences from TCP Congestion control 🆚
Gap Ack Blocks in the SCTP SACK carry the same semantic meaning as the TCP SACK. TCP treats the information carried in the SACK as advisory information only. SCTP also treats the information carried in the Gap Ack Blocks in the SACK chunk as advisory. In SCTP, any DATA chunk that has been acknowledged by SACK, including DATA that arrived out of order at the receiving end, is not considered fully delivered until the Cumulative TSN Ack Point passes the TSN of that DATA chunk (that is, the DATA chunk has been acknowledged by the Cumulative TSN Ack field in the SACK). 🫠 Because of that, the value of cwnd controls the amount of outstanding data. In non-SACK TCP, it's instead the upper bound between the highest acknowledged sequence number and the latest DATA chunk that can be sent within the congestion window. SCTP SACK also leads to different implementations of fast-retransmit and fast-recovery than non-SACK TCP. For an example, see [FALL96]. 🦋
The biggest difference between SCTP and TCP, though, is multi-homing 🌈 SCTP is designed to establish robust communication associations between two endpoints, each of which may be reachable by more than one transport address. Different addresses may lead to different data paths between the two endpoints, so ideally you'd need a separate set of congestion control parameters for each path. The treatment here of congestion control for multi-homed receivers is new with SCTP and may need refinement in the future. The current algorithms make the following assumptions:
- The sender usually uses the same destination address until the upper layer instructs otherwise. However, SCTP may change to an alternate destination if an address is marked inactive (see Section 8.2). Also, SCTP may retransmit to a different transport address than the original transmission. 🔁
- The sender keeps a separate congestion control parameter set for each of the destination addresses it can send to. That's per destination, not per source-destination pair. The parameters should decay if the address isn't used for a long enough time period. ⏳
- For each of the destination addresses, an endpoint does slow-start upon the first transmission to that address. 🐣
Note: TCP guarantees in-sequence delivery of data to its upper-layer protocol within a single TCP session. This means that when TCP notices a gap in the received sequence number, it waits until the gap is filled before delivering the data that was received with sequence numbers higher than the missing data. SCTP, on the other hand, can deliver data to its upper-layer protocol even if there's a gap in TSN, as long as the Stream Sequence Numbers are in sequence for a particular stream (that is, the missing DATA chunks belong to a different stream), or if unordered delivery is indicated. Although this doesn't affect cwnd, it might affect the rwnd calculation. 🧠
7.2 SCTP Slow-Start and Congestion Avoidance 🐢🚀
The slow start and congestion avoidance algorithms MUST be used by an endpoint to control the amount of data being injected into the network. Congestion control in SCTP is handled for the association, not for an individual stream. In some situations it may be beneficial for an SCTP sender to be more conservative than the algorithms allow. However, an SCTP sender MUST NOT be more aggressive than the following algorithms allow. Gentle but never reckless, that's the energy 🫧
Like TCP, an SCTP endpoint uses the following three control variables to regulate its transmission rate:
- Receiver advertised window size (rwnd, in bytes), which is set by the receiver based on its available buffer space for incoming packets. 🪟
Note: This variable is kept on the entire association.
- Congestion control window (cwnd, in bytes), which is adjusted by the sender based on observed network conditions. 🪟
Note: This variable is maintained on a per-destination address basis.
- Slow-start threshold (ssthresh, in bytes), which is used by the sender to distinguish the slow start and congestion avoidance phases. 🪟
Note: This variable is maintained on a per-destination address basis.
SCTP also requires one additional control variable, partial_bytes_acked, which is used during the congestion avoidance phase to facilitate cwnd adjustment. 🧮
Unlike TCP, an SCTP sender MUST keep a set of these control variables (cwnd, ssthresh and partial_bytes_acked) for EACH destination address of its peer (when its peer is multi-homed). Only one rwnd is kept for the whole association, no matter whether the peer is multi-homed or has a single address. That's the whole tea ☕💖
7.2.1 Slow-Start
Okay bestie, so sending data into a network when nobody knows what conditions are like (or after a long nap 😴) means SCTP has to probe the network to figure out how much room there is 🧚. That's what slow start is for! It kicks in at the start of a transfer, or after fixing loss that the retransmission timer spotted 💅.
- The initial cwnd before DATA transmission or after a sufficiently long idle period MUST be
<= 2*MTU. ✨ - The initial cwnd after a retransmission timeout MUST be no more than 1*MTU. 🫶
- The initial value of ssthresh MAY be arbitrarily high (for example, implementations MAY use the size of the receiver advertised window). 🌈
- Whenever cwnd is greater than zero, the endpoint is allowed to have cwnd bytes of data outstanding on that transport address. 🦋
- When cwnd is less than or equal to ssthresh, an SCTP endpoint MUST use the slow start algorithm to increase cwnd (assuming the current congestion window is being fully utilized). If an incoming SACK advances the Cumulative TSN Ack Point, cwnd MUST be increased by at most the lesser of 1) the total size of the previously outstanding DATA chunk(s) acknowledged, and 2) the destination's path MTU. This protects against the ACK-Splitting attack outlined in [SAVAGE99]. 🔥
Multi-homed peers get their own little rules too, so pay attention 🎀. If an endpoint's peer is multi-homed and it receives a SACK that advances its Cumulative TSN Ack Point, then it should update its cwnd (or cwnds) apportioned to the destination addresses it sent the acknowledged data to. However, if the received SACK does not advance the Cumulative TSN Ack Point, the endpoint MUST NOT adjust the cwnd of any of the destination addresses. 🙈
Here's the tea ☕. An endpoint's cwnd isn't tied to its Cumulative TSN Ack Point, so duplicate SACKs can still be used to clock out new data, even though they don't advance the point. The data newly acknowledged by the SACK shrinks the amount in flight to less than cwnd, so the unchanged cwnd suddenly lets new data go out. But the increase of cwnd has to stay tied to the Cumulative TSN Ack Point advancing, like we just said. Otherwise those duplicate SACKs would clock out even more new data than has actually left the network, right when there might be congestion 😭.
- When the endpoint does not transmit data on a given transport address, the cwnd of that transport address should be adjusted to
max(cwnd/2, 2*MTU)per RTO. 🍓
7.2.2 Congestion Avoidance
When cwnd is greater than ssthresh, cwnd should be incremented by 1*MTU per RTT if the sender has cwnd or more bytes of data outstanding for the corresponding transport address. 👑
In practice, an implementation can get there this way 🧁:
partial_bytes_ackedis initialized to 0. 🌸- Whenever cwnd is greater than ssthresh, upon each SACK arrival that advances the Cumulative TSN Ack Point, increase
partial_bytes_ackedby the total number of bytes of all new chunks acknowledged in that SACK, including chunks acknowledged by the new Cumulative TSN Ack and by Gap Ack Blocks. 💖 - When
partial_bytes_ackedis equal to or greater than cwnd, and before the arrival of the SACK the sender had cwnd or more bytes of data outstanding (i.e., before arrival of the SACK, flightsize was greater than or equal to cwnd), increase cwnd by MTU, and resetpartial_bytes_ackedto (partial_bytes_acked- cwnd). ✨ - Same as in the slow start, when the sender does not transmit DATA on a given transport address, the cwnd of that transport address should be adjusted to
max(cwnd / 2, 2*MTU)per RTO. 🦋 - When all of the data transmitted by the sender has been acknowledged by the receiver,
partial_bytes_ackedis initialized to 0. 🫶
7.2.3 Congestion Control
Upon detection of packet losses from SACK (see Section 7.2.4), an endpoint should do the following 🔍:
ssthresh = max(cwnd/2, 2*MTU)
cwnd = ssthreshBasically, a packet loss causes cwnd to be cut in half. 💀
When the T3-rtx timer expires on an address, SCTP should perform slow start by:
ssthresh = max(cwnd/2, 2*MTU)
cwnd = 1*MTUand assure that no more than one SCTP packet will be in flight for that address until the endpoint receives acknowledgement for successful delivery of data to that address. 🌈
7.2.4 Fast Retransmit on Gap Reports
When there's no data loss, an endpoint does delayed acknowledgement, which is very chill 😌. But the second it notices a hole in the arriving TSN sequence, it SHOULD start sending a SACK back every time a packet carrying data arrives, until the hole is filled. 🕵️♀️
Whenever an endpoint receives a SACK that says some TSN(s) are missing, it SHOULD wait for 3 more miss indications (via subsequent SACK's) on the same TSN(s) before doing anything about Fast Retransmit. Patience is a virtue, babe 🧚.
When the TSN(s) is reported as missing in the fourth consecutive SACK, the data sender shall:
- Mark the missing DATA chunk(s) for retransmission. 🎀
- Adjust the ssthresh and cwnd of the destination address(es) to which the missing DATA chunks were last sent, according to the formula described in Section 7.2.3. 💅
- Determine how many of the earliest (i.e., lowest TSN) DATA chunks marked for retransmission will fit into a single packet, subject to the constraint of the path MTU of the destination transport address to which the packet is being sent. Call this value K. Retransmit those K DATA chunks in a single packet. 📦
- Restart the T3-rtx timer only if the last SACK acknowledged the lowest outstanding TSN number sent to that address, or the endpoint is retransmitting the first outstanding DATA chunk sent to that address. ⏰
Note: Before the above adjustments, if the received SACK also acknowledges new DATA chunks and advances the Cumulative TSN Ack Point, the cwnd adjustment rules defined in Sections 7.2.1 and 7.2.2 must be applied first. 👀
A straightforward implementation of the above keeps a counter for each TSN hole reported by a SACK. The counter goes up for each consecutive SACK reporting that TSN hole. Once it hits 4 and fast retransmit starts, the counter resets to 0 🔢.
Because cwnd in SCTP indirectly bounds the number of outstanding TSN's, the effect of TCP fast-recovery is achieved automatically, with no adjustment to the congestion control window size. Iconic, honestly 👑.
7.3. Path MTU Discovery
[RFC1191] specifies "Path MTU Discovery", where an endpoint keeps an estimate of the maximum transmission unit (MTU) along a given Internet path and doesn't send packets along that path that exceed the MTU, except for occasional attempts to probe for a change in the Path MTU (PMTU). RFC 1191 is thorough about the MTU discovery mechanism and about strategies for finding the current end-to-end MTU setting and spotting changes to it 🗺️. [RFC1981] specifies the same mechanisms for IPv6. An SCTP sender using IPv6 MUST use Path MTU Discovery unless all packets are less than the minimum IPv6 MTU [RFC2460]. 🌸
An endpoint SHOULD apply these techniques, and SHOULD do so on a per-destination-address basis. 💖
There are 4 ways SCTP differs from the description in RFC 1191 of applying MTU discovery to TCP. Let's go ✨:
- SCTP associations can span multiple addresses. An endpoint MUST maintain separate MTU estimates for each destination address of its peer. 🏠
- Elsewhere in this document, when the term "MTU" is discussed, it refers to the MTU associated with the destination address corresponding to the context of the discussion. 🎯
- Unlike TCP, SCTP doesn't have a notion of "Maximum Segment Size". So the MTU for each destination address SHOULD be initialized to a value no larger than the link MTU for the local interface that packets for that remote destination address will be routed through. 🧩
- Since data transmission in SCTP is naturally structured in terms of TSNs rather than bytes (as is the case for TCP), the discussion in Section 6.5 of RFC 1191 applies: When retransmitting an IP datagram to a remote address for which the IP datagram appears too large for the path MTU to that address, the IP datagram SHOULD be retransmitted without the DF bit set, allowing it to possibly be fragmented. Transmissions of new IP datagrams MUST have DF set. 🦋
- The sender should track an association PMTU, which will be the smallest PMTU discovered for all of the peer's destination addresses. When fragmenting messages into multiple parts, this association PMTU should be used to calculate the size of each fragment. This allows retransmissions to be seamlessly sent to an alternate address without encountering IP fragmentation. 🫧
Other than these differences, the discussion of TCP's use of MTU discovery in RFCs 1191 and 1981 applies to SCTP on a per-destination-address basis. 💜
Note: For IPv6 destination addresses the DF bit does not exist; instead, the IP datagram must be fragmented as described in [RFC2460]. 🙈
8. Fault Management
8.1. Endpoint Failure Detection
An endpoint shall keep a counter of the total number of consecutive retransmissions to its peer (including retransmissions to all the destination transport addresses of the peer if it is multi-homed). If the value of this counter exceeds the limit indicated in the protocol parameter Association.Max.Retrans, the endpoint shall consider the peer endpoint unreachable and shall stop transmitting any more data to it (and thus the association enters the CLOSED state). 😱 In addition, the endpoint shall report the failure to the upper layer, and optionally report back all outstanding user data remaining in its outbound queue. The association is automatically closed when the peer endpoint becomes unreachable. 🚪
The counter shall be reset each time a DATA chunk sent to that peer endpoint is acknowledged (by the reception of a SACK), or a HEARTBEAT-ACK is received from the peer endpoint. 🔄
8.2 Path Failure Detection 🛣️
Okay so when your peer endpoint is multi-homed (reachable through more than one address, bestie 🌸), your endpoint should keep an error counter for each of the peer's destination transport addresses. Every path gets its own tracker, no cap 💅
Each time the T3-rtx timer expires on any address, or when a HEARTBEAT sent to an idle address isn't acknowledged within an RTO, that address's error counter goes up by one 📈. Once the counter goes over the protocol parameter Path.Max.Retrans for that destination address, the endpoint should mark it as inactive, and a notification SHOULD be sent to the upper layer 🚨. Yikes, that's a whole breakup. 💀
When an outstanding TSN gets acknowledged, or a HEARTBEAT sent to that address gets a HEARTBEAT ACK back, the endpoint shall clear the error counter of the destination transport address that the DATA chunk was last sent to (or that the HEARTBEAT was sent to) ✨. Here's where it gets a little messy 🙈. If the peer is multi-homed and the last chunk sent was a retransmission to an alternate address, it's unclear whether that acknowledgement should count for the address the last chunk was sent to. BUT lowkey this ambiguity doesn't seem to cause any real trouble for SCTP behavior, so it's fine 🫶. If you'd rather avoid the ambiguity, the transmitter may choose not to clear the error counter when the last chunk sent was a retransmission 🦋.
Note: When you configure the SCTP endpoint, please don't letAssociation.Max.Retransget bigger than the sum of thePath.Max.Retransvalues of all the destination addresses for the remote endpoint 🙏. If it does, every destination address could go inactive while the endpoint still thinks the peer is reachable 😭. When that happens, how SCTP behaves is implementation specific 🤷♀️.
When the primary path gets marked inactive (because of too many retransmissions, for instance), the sender MAY automatically transmit new packets to an alternate destination address, as long as one exists and is active 🧚. If more than one alternate address is active at that moment, only ONE transport address SHOULD be chosen and used as the new destination transport address 👑.
8.3 Path Heartbeat 💓
By default, an SCTP endpoint shall keep an eye on whether the idle destination transport address(es) of its peer are still reachable, by periodically sending a HEARTBEAT chunk to them 🔍✨.
A destination transport address counts as "idle" if no new chunk that can be used for updating path RTT has been sent to it, and no HEARTBEAT has been sent to it, within that address's current heartbeat period 🌙. (Those RTT-updating chunks usually include first-transmission DATA, INIT, COOKIE ECHO, HEARTBEAT and so on.) This applies to both active and inactive destination addresses 💜.
The upper layer can optionally kick off any of these functions 🎀:
- A) Disable heartbeat on a specific destination transport address of a given association,
- B) Change the HB.interval,
- C) Re-enable heartbeat on a specific destination transport address of a given association, and,
- D) Request an on-demand HEARTBEAT on a specific destination transport address of a given association.
The endpoint should increment the matching error counter of the destination transport address each time a HEARTBEAT is sent to that address and isn't acknowledged within one RTO 📉.
Once that counter reaches the protocol parameter Path.Max.Retrans, the endpoint should mark the corresponding destination address as inactive (if it isn't already), and it may also optionally report the change in reachability to the upper layer 🚩. After that, the endpoint should keep sending HEARTBEATs to that destination address, but should stop increasing the counter 🫠.
The sender of the HEARTBEAT chunk should put the current time, and the destination address the packet is being sent to, into the Heartbeat Information field of the chunk when the packet goes out ⏰.
IMPLEMENTATION NOTE: An alternative way to do heartbeats is to increment the error counter every time a HEARTBEAT is sent to a destination. Whenever a HEARTBEAT ACK arrives, the sender SHOULD clear the error counter of the destination the HEARTBEAT was sent to. Effectively, this wipes the previously stroked error (and any other error counts too) 🧹.
The receiver of the HEARTBEAT should respond right away with a HEARTBEAT ACK that contains the Heartbeat Information field copied from the received HEARTBEAT chunk 💨.
When the sender gets that HEARTBEAT ACK, it should clear the error counter of the destination transport address the HEARTBEAT was sent to, and mark that address as active if it isn't already 🌈. The endpoint may optionally tell the upper layer when an inactive destination address gets marked active because of the latest HEARTBEAT ACK. The receiver of the HEARTBEAT ACK must also clear the association overall error count (as defined in section 8.1) 🧼.
The receiver of the HEARTBEAT ACK should also do an RTT measurement for that destination transport address, using the time value carried in the HEARTBEAT ACK chunk 📏.
On an idle destination address that's allowed to heartbeat, a HEARTBEAT chunk is RECOMMENDED to be sent once per RTO of that destination address plus the protocol parameter HB.interval, with jittering of +/- 50%, and exponential back-off of the RTO if the previous HEARTBEAT goes unanswered 🎲✨.
There's a primitive the SCTP user can call to change the HB.interval and turn heartbeat on or off for a given destination address 🕹️. The heartbeat interval the SCTP user sets gets added to that destination's RTO (including any exponential backoff). Only one heartbeat should be sent each time the heartbeat timer expires (if multiple destinations are idle). Choosing which idle destination to heartbeat to, when there's more than one, is an implementation decision 🧠.
Note: When you tune the heartbeat interval, there's a side effect you SHOULD keep in mind 👀. When this value goes up (so the HEARTBEAT takes longer), detecting lost ABORT messages also takes longer 😩. If a peer endpoint ABORTs the association for any reason and that ABORT chunk gets lost, the local endpoint will only discover the lost ABORT by sending a DATA chunk or HEARTBEAT chunk (which makes the peer send another ABORT) 🔁. Keep this in mind when you tune the HEARTBEAT timer. If HEARTBEAT is disabled, only sending DATA to the association will reveal a lost ABORT from the peer 💅.
8.4 Handle "Out of the blue" Packets 👻
An SCTP packet counts as an "out of the blue" (OOTB) packet if it's correctly formed (it passed the receiver's Adler-32 check, see Section 6.8) but the receiver can't figure out which association it belongs to 🌫️.
The receiver of an OOTB packet MUST do the following 📋:
- If the OOTB packet is to or from a non-unicast address, silently discard the packet. Otherwise,
- If the OOTB packet contains an ABORT chunk, the receiver MUST silently discard the OOTB packet and take no further action. Otherwise,
- If the packet contains an INIT chunk with a Verification Tag set to
0, process it as described in Section 5.1. Otherwise, - If the packet contains a COOKIE ECHO in the first chunk, process it as described in Section 5.1. Otherwise,
- If the packet contains a SHUTDOWN ACK chunk, the receiver should respond to the sender of the OOTB packet with a SHUTDOWN COMPLETE. When sending the SHUTDOWN COMPLETE, the receiver of the OOTB packet must fill in the Verification Tag field of the outbound packet with the Verification Tag received in the SHUTDOWN ACK and set the T-bit in the Chunk Flags to indicate that no TCB was found. Otherwise,
- If the packet contains a SHUTDOWN COMPLETE chunk, the receiver should silently discard the packet and take no further action. Otherwise,
- If the packet contains a "Stale cookie" ERROR or a COOKIE ACK, the SCTP Packet should be silently discarded. Otherwise,
- The receiver should respond to the sender of the OOTB packet with an ABORT. When sending the ABORT, the receiver of the OOTB packet MUST fill in the Verification Tag field of the outbound packet with the value found in the Verification Tag field of the OOTB packet and set the T-bit in the Chunk Flags to indicate that no TCB was found. After sending this ABORT, the receiver of the OOTB packet shall discard the OOTB packet and take no further action.
8.5 Verification Tag 🏷️
The Verification Tag rules in this section apply when sending or receiving SCTP packets that don't contain an INIT, SHUTDOWN COMPLETE, COOKIE ECHO (see Section 5.1), ABORT or SHUTDOWN ACK chunk 🎟️. The rules for sending and receiving SCTP packets with one of those chunk types are covered separately in Section 8.5.1.
When sending an SCTP packet, the endpoint MUST fill in the Verification Tag field of the outbound packet with the tag value in the Initiate Tag parameter of the INIT or INIT ACK it received from its peer 💌.
When receiving an SCTP packet, the endpoint MUST make sure the value in the Verification Tag field of the received SCTP packet matches its own Tag 🔐. If the received Verification Tag value doesn't match the receiver's own tag value, the receiver shall silently discard the packet and shall not process it any further, except for the cases listed in Section 8.5.1 below 🙅♀️.
Mic drop, we're on to the next one 🌈💖
8.5.1 Exceptions in Verification Tag Rules ✨
okay so the Verification Tag rules have some exceptions, and they're kinda the main character of this section 💅 here's how each packet type gets treated 🦋
A) Rules for packet carrying INIT: 🌸
- The sender MUST set the Verification Tag of the packet to 0.
- When an endpoint receives an SCTP packet with the Verification Tag set to 0, it should verify that the packet contains only an INIT chunk. Otherwise, the receiver MUST silently discard the packet.
B) Rules for packet carrying ABORT: 💀
- The endpoint shall always fill in the Verification Tag field of the outbound packet with the destination endpoint's tag value if it is known.
- If the ABORT is sent in response to an OOTB packet, the endpoint MUST follow the procedure described in Section 8.4.
- The receiver MUST accept the packet if the Verification Tag matches either its own tag, OR the tag of its peer. Otherwise, the receiver MUST silently discard the packet and take no further action.
C) Rules for packet carrying SHUTDOWN COMPLETE: 🎀
- When sending a
SHUTDOWN COMPLETE, if the receiver of theSHUTDOWN ACKhas a TCB then the destination endpoint's tag MUST be used. Only where no TCB exists should the sender use the Verification Tag from theSHUTDOWN ACK. - The receiver of a
SHUTDOWN COMPLETEshall accept the packet if the Verification Tag field of the packet matches its own tag OR it is set to its peer's tag and the T bit is set in the Chunk Flags. Otherwise, the receiver MUST silently discard the packet and take no further action. An endpoint MUST ignore theSHUTDOWN COMPLETEif it is not in theSHUTDOWN-ACK-SENTstate.
D) Rules for packet carrying a COOKIE ECHO: 🧚
- When sending a
COOKIE ECHO, the endpoint MUST use the value of the Initial Tag received in theINIT ACK. - The receiver of a
COOKIE ECHOfollows the procedures in Section 5.
E) Rules for packet carrying a SHUTDOWN ACK: 🙈
- If the receiver is in
COOKIE-ECHOEDorCOOKIE-WAITstate the procedures in section 8.4 SHOULD be followed, in other words it should be treated as an Out Of The Blue packet.
9. Termination of Association 🌈
An endpoint should terminate its association when it exits from service. An association can be terminated by either abort or shutdown. An abort of an association is abortive by definition in that any data pending on either end of the association is discarded and not delivered to the peer. A shutdown of an association is considered a graceful close where all data in queue by either endpoint is delivered to the respective peers. However, in the case of a shutdown, SCTP does not support a half-open state (like TCP) wherein one side may continue sending data while the other end is closed. When either endpoint performs a shutdown, the association on each peer will stop accepting new data from its user and only deliver data in queue at the time of sending or receiving the SHUTDOWN chunk.
9.1 Abort of an Association 💖
When an endpoint decides to abort an existing association, it shall send an ABORT chunk to its peer endpoint. The sender MUST fill in the peer's Verification Tag in the outbound packet and MUST NOT bundle any DATA chunk with the ABORT.
An endpoint MUST NOT respond to any received packet that contains an ABORT chunk (also see Section 8.4).
An endpoint receiving an ABORT shall apply the special Verification Tag check rules described in Section 8.5.1.
After checking the Verification Tag, the receiving endpoint shall remove the association from its record, and shall report the termination to its upper layer.
9.2 Shutdown of an Association 🫶
Using the SHUTDOWN primitive (see Section 10.1), the upper layer of an endpoint in an association can gracefully close the association. This will allow all outstanding DATA chunks from the peer of the shutdown initiator to be delivered before the association terminates.
Upon receipt of the SHUTDOWN primitive from its upper layer, the endpoint enters SHUTDOWN-PENDING state and remains there until all outstanding data has been acknowledged by its peer. The endpoint accepts no new data from its upper layer, but retransmits data to the far end if necessary to fill gaps.
Once all its outstanding data has been acknowledged, the endpoint shall send a SHUTDOWN chunk to its peer including in the Cumulative TSN Ack field the last sequential TSN it has received from the peer. It shall then start the T2-shutdown timer and enter the SHUTDOWN-SENT state. If the timer expires, the endpoint must re-send the SHUTDOWN with the updated last sequential TSN received from its peer.
The rules in Section 6.3 MUST be followed to determine the proper timer value for T2-shutdown. To indicate any gaps in TSN, the endpoint may also bundle a SACK with the SHUTDOWN chunk in the same SCTP packet.
An endpoint should limit the number of retransmissions of the SHUTDOWN chunk to the protocol parameter 'Association.Max.Retrans'. If this threshold is exceeded the endpoint should destroy the TCB and MUST report the peer endpoint unreachable to the upper layer (and thus the association enters the CLOSED state). The reception of any packet from its peer (i.e. as the peer sends all of its queued DATA chunks) should clear the endpoint's retransmission count and restart the T2-Shutdown timer, giving its peer ample opportunity to transmit all of its queued DATA chunks that have not yet been sent.
Upon the reception of the SHUTDOWN, the peer endpoint shall:
- enter the
SHUTDOWN-RECEIVEDstate, - stop accepting new data from its SCTP user,
- verify, by checking the Cumulative TSN Ack field of the chunk, that all its outstanding DATA chunks have been received by the
SHUTDOWNsender.
Once an endpoint as reached the SHUTDOWN-RECEIVED state it MUST NOT send a SHUTDOWN in response to a ULP request, and should discard subsequent SHUTDOWN chunks.
If there are still outstanding DATA chunks left, the SHUTDOWN receiver shall continue to follow normal data transmission procedures defined in Section 6 until all outstanding DATA chunks are acknowledged; however, the SHUTDOWN receiver MUST NOT accept new data from its SCTP user.
While in SHUTDOWN-SENT state, the SHUTDOWN sender MUST immediately respond to each received packet containing one or more DATA chunk(s) with a SACK, a SHUTDOWN chunk, and restart the T2-shutdown timer. If it has no more outstanding DATA chunks, the SHUTDOWN receiver shall send a SHUTDOWN ACK and start a T2-shutdown timer of its own, entering the SHUTDOWN-ACK-SENT state. If the timer expires, the endpoint must re-send the SHUTDOWN ACK.
The sender of the SHUTDOWN ACK should limit the number of retransmissions of the SHUTDOWN ACK chunk to the protocol parameter 'Association.Max.Retrans'. If this threshold is exceeded the endpoint should destroy the TCB and may report the peer endpoint unreachable to the upper layer (and thus the association enters the CLOSED state).
Upon the receipt of the SHUTDOWN ACK, the SHUTDOWN sender shall stop the T2-shutdown timer, send a SHUTDOWN COMPLETE chunk to its peer, and remove all record of the association.
Upon reception of the SHUTDOWN COMPLETE chunk the endpoint will verify that it is in SHUTDOWN-ACK-SENT state, if it is not the chunk should be discarded. If the endpoint is in the SHUTDOWN-ACK-SENT state the endpoint should stop the T2-shutdown timer and remove all knowledge of the association (and thus the association enters the CLOSED state).
An endpoint SHOULD assure that all its outstanding DATA chunks have been acknowledged before initiating the shutdown procedure.
An endpoint should reject any new data request from its upper layer if it is in SHUTDOWN-PENDING, SHUTDOWN-SENT, SHUTDOWN-RECEIVED, or SHUTDOWN-ACK-SENT state.
If an endpoint is in SHUTDOWN-ACK-SENT state and receives an INIT chunk (e.g., if the SHUTDOWN COMPLETE was lost) with source and destination transport addresses (either in the IP addresses or in the INIT chunk) that belong to this association, it should discard the INIT chunk and retransmit the SHUTDOWN ACK chunk.
Note: Receipt of an INIT with the same source and destination IP addresses as used in transport addresses assigned to an endpoint but with a different port number indicates the initialization of a separate association.
The sender of the INIT or COOKIE ECHO should respond to the receipt of a SHUTDOWN ACK with a stand-alone SHUTDOWN COMPLETE in an SCTP packet with the Verification Tag field of its common header set to the same tag that was received in the SHUTDOWN ACK packet. This is considered an Out of the Blue packet as defined in Section 8.4. The sender of the INIT lets T1-init continue running and remains in the COOKIE-WAIT or COOKIE-ECHOED state. Normal T1-init timer expiration will cause the INIT or COOKIE chunk to be retransmitted and thus start a new association.
If a SHUTDOWN is received in COOKIE WAIT or COOKIE ECHOED states the SHUTDOWN chunk SHOULD be silently discarded.
If an endpoint is in SHUTDOWN-SENT state and receives a SHUTDOWN chunk from its peer, the endpoint shall respond immediately with a SHUTDOWN ACK to its peer, and move into a SHUTDOWN-ACK-SENT state restarting its T2-shutdown timer.
If an endpoint is in the SHUTDOWN-ACK-SENT state and receives a SHUTDOWN ACK, it shall stop the T2-shutdown timer, send a SHUTDOWN COMPLETE chunk to its peer, and remove all record of the association.
10. Interface with Upper Layer 🎀
The Upper Layer Protocols (ULP) shall request for services by passing primitives to SCTP and shall receive notifications from SCTP for various events.
The primitives and notifications described in this section should be used as a guideline for implementing SCTP. The following functional description of ULP interface primitives is shown for illustrative purposes. Different SCTP implementations may have different ULP interfaces. However, all SCTPs must provide a certain minimum set of services to guarantee that all SCTP implementations can support the same protocol hierarchy.
10.1 ULP-to-SCTP 🍓
The following sections functionally characterize a ULP/SCTP interface. The notation used is similar to most procedure or function calls in high level languages.
The ULP primitives described below specify the basic functions the SCTP must perform to support inter-process communication. Individual implementations must define their own exact format, and may provide combinations or subsets of the basic functions in single calls.
A) Initialize 🦋
Format: INITIALIZE ([local port], [local eligible address list]) ->
local SCTP instance nameThis primitive allows SCTP to initialize its internal data structures and allocate necessary resources for setting up its operation environment. Once SCTP is initialized, ULP can communicate directly with other endpoints without re-invoking this primitive.
SCTP will return a local SCTP instance name to the ULP.
Mandatory attributes:
None.
Optional attributes:
The following types of attributes may be passed along with the primitive:
- local port - SCTP port number, if ULP wants it to be specified;
- local eligible address list - An address list that the local SCTP endpoint should bind. By default, if an address list is not included, all IP addresses assigned to the host should be used by the local endpoint.
IMPLEMENTATION NOTE 💅 This optional attribute is the one we just talked about, and if an implementation supports it, the implementation has to make sure the IP source address field of every SCTP packet this endpoint sends contains one of the IP addresses in the local eligible address list 🫶
B) Associate ✨
Format:
ASSOCIATE(local SCTP instance name, destination transport addr,
outbound stream count)
-> association id [,destination transport addr list] [,outbound stream
count]okay so ASSOCIATE is how the upper layer starts an association with a specific peer endpoint 🦋 The peer gets named by one of the transport addresses that defines its endpoint (see Section 1.4). If the local SCTP instance hasn't been initialized yet, the ASSOCIATE is treated as an error 🙈
When it works, you get back an association id, which is just a local handle to the association 🎀 If SCTP can't open an association with the peer, you get an error instead 💀
You can also get other association parameters back, like the complete destination transport addresses of the peer and the outbound stream count of the local endpoint 🌸 The local endpoint picks one of those returned destination addresses as the default primary path for sending SCTP packets to this peer 👑 The returned "destination transport addr list" lets the ULP change the default primary path or force a packet to go to a specific transport address, which is so useful ngl ✨
IMPLEMENTATION NOTE: If ASSOCIATE is implemented as a blocking function call, it can return association parameters along with the association id once the association is up 🧚 If it's a non-blocking call, only the association id shall be returned, and the association parameters shall be passed using the COMMUNICATION UP notification 💜
Mandatory attributes:
- local SCTP instance name - obtained from the INITIALIZE operation.
- destination transport addr - specified as one of the transport addresses of the peer endpoint with which the association is to be established.
- outbound stream count - the number of outbound streams the ULP would like to open towards this peer endpoint.
Optional attributes:
None.
C) Shutdown 🌈
Format:
SHUTDOWN(association id)
-> resultShutdown is the polite exit 🫶 It gracefully closes an association, and any user data sitting in the local queue gets delivered to the peer first. The association only terminates after the peer acknowledges all the SCTP packets that were sent. A success code comes back when the termination works out, and if it fails, an error code shall be returned 😭
Mandatory attributes:
- association id - local handle to the SCTP association
Optional attributes:
None.
D) Abort 💀
Format:
ABORT(association id [, cause code])
-> resultAbort is the no-drama, rip-the-bandaid version 🔥 It ungracefully closes an association. Any locally queued user data gets discarded, and an ABORT chunk is sent to the peer. A success code is returned when the abort works, and if the abort fails, an error code shall be returned 🥀
Mandatory attributes:
- association id - local handle to the SCTP association
Optional attributes:
- cause code - reason of the abort to be passed to the peer.
None.
E) Send 🍓
Format:
SEND(association id, buffer address, byte count [,context]
[,stream id] [,life time] [,destination transport address]
[,unorder flag] [,no-bundle flag] [,payload protocol-id] )
-> resultThis is the main way to send user data via SCTP, so this is the one you'll use most 💖
Mandatory attributes:
- association id - local handle to the SCTP association
- buffer address - the location where the user message to be transmitted is stored;
- byte count - The size of the user data in number of bytes;
Optional attributes:
- context - an optional 32 bit integer that will be carried in the sending failure notification to the ULP if the transportation of this User Message fails.
- stream id - to indicate which stream to send the data on. If not specified, stream 0 will be used.
- life time - specifies the life time of the user data. The user data will not be sent by SCTP after the life time expires. This parameter can be used to avoid efforts to transmit stale user messages. SCTP notifies the ULP if the data cannot be initiated to transport (i.e. sent to the destination via SCTP's send primitive) within the life time variable. However, the user data will be transmitted if SCTP has attempted to transmit a chunk before the life time expired. ⏳
IMPLEMENTATION NOTE: To better support the data lifetime option, the transmitter can hold off on assigning a TSN number to an outbound DATA chunk until the very last moment 🧠 And for implementation simplicity, once a TSN number has been assigned, the sender should consider the send of this DATA chunk as committed, overriding any lifetime option attached to the DATA chunk 🔒
- destination transport address - specified as one of the destination transport addresses of the peer endpoint to which this packet should be sent. Whenever possible, SCTP should use this destination transport address for sending the packets, instead of the current primary path. 🦋
- unorder flag - this flag, if present, indicates that the user would like the data delivered in an unordered fashion to the peer (i.e., the U flag is set to 1 on all DATA chunks carrying this message). 🌀
- no-bundle flag - instructs SCTP not to bundle this user data with other outbound DATA chunks. SCTP MAY still bundle even when this flag is present, when faced with network congestion. 🚦
- payload protocol-id - A 32 bit unsigned integer that is to be passed to the peer indicating the type of payload protocol data being transmitted. This value is passed as opaque data by SCTP. 🧚
F) Set Primary 👑
Format:
SETPRIMARY(association id, destination transport address,
[source transport address] )
-> resultThis one tells the local SCTP which destination transport address to use as the primary path for sending packets 🛤️
The result of this operation shall be returned. If the specified destination transport address isn't in the "destination transport address list" that came back earlier from an associate command or a communication up notification, an error shall be returned 🙅♀️
Mandatory attributes:
- association id - local handle to the SCTP association
- destination transport address - specified as one of the transport addresses of the peer endpoint, which should be used as primary address for sending packets. This overrides the current primary address information maintained by the local SCTP endpoint.
Optional attributes:
- source transport address - optionally, some implementations may allow you to set the default source address placed in all outgoing IP datagrams.
G) Receive 📬
Format:
RECEIVE(association id, buffer address, buffer size
[,stream id])
-> byte count [,transport address] [,stream id] [,stream sequence
number] [,partial flag] [,delivery number] [,payload protocol-id]This primitive reads the first user message in the SCTP in-queue into the buffer the ULP specified, if there's one available 📥 The size of the message read, in bytes, gets returned. Depending on the implementation, it can also hand back other info like the sender's address, the stream id it came in on, and whether more messages are waiting 💌 For ordered messages, the stream sequence number might come back too 🔢
Depending on the implementation, if this primitive gets invoked when no message is available, the implementation should return an indication of this condition, or it should block the invoking process until data does become available 😴
Mandatory attributes:
- association id - local handle to the SCTP association
- buffer address - the memory location indicated by the ULP to store the received message.
- buffer size - the maximum size of data to be received, in bytes.
Optional attributes:
- stream id - to indicate which stream to receive the data on.
- stream sequence number - the stream sequence number assigned by the sending SCTP peer.
- partial flag - if this returned flag is set to 1, then this Receive contains a partial delivery of the whole message. When this flag is set, the stream id and stream sequence number MUST accompany this receive. When this flag is set to 0, it indicates that no more deliveries will be received for this stream sequence number. 🧩
- payload protocol-id - A 32 bit unsigned integer that is received from the peer indicating the type of payload protocol of the received data. This value is passed as opaque data by SCTP.
H) Status 📊
Format:
STATUS(association id)
-> status dataThis primitive should return a data block with all the good stuff in it 🧾 The info includes:
- association connection state
- destination transport address list
- destination transport address reachability states
- current receiver window size
- current congestion window sizes
- number of unacknowledged DATA chunks
- number of DATA chunks pending receipt
- primary path
- most recent SRTT on primary path
- RTO on primary path
- SRTT and RTO on other destination addresses, etc.
Mandatory attributes:
- association id - local handle to the SCTP association
Optional attributes:
None.
I) Change Heartbeat 💓
Format:
CHANGEHEARTBEAT(association id, destination transport address,
new state [,interval])
-> resultThis instructs the local endpoint to enable or disable heartbeat on the specified destination transport address 🔁
The result of this operation shall be returned.
Note: Even when enabled, heartbeat won't happen if the destination transport address isn't idle 🙈
Mandatory attributes:
- association id - local handle to the SCTP association
- destination transport address - specified as one of the transport addresses of the peer endpoint.
- new state - the new state of heartbeat for this destination transport address (either enabled or disabled).
Optional attributes:
- interval - if present, indicates the frequency of the heartbeat if this is to enable heartbeat on a destination transport address. This value is added to the RTO of the destination transport address. This value, if present, effects all destinations. ⏱️
J) Request HeartBeat 💌
Format:
REQUESTHEARTBEAT(association id, destination transport
address)
-> resultThis tells the local endpoint to send a HeartBeat on the specified destination transport address of the given association 💞 The returned result should indicate whether the transmission of the HEARTBEAT chunk to the destination address was successful.
Mandatory attributes:
- association id - local handle to the SCTP association
- destination transport address - the transport address of the association on which a heartbeat should be issued.
K) Get SRTT Report 📈
Format:
GETSRTTREPORT(association id, destination transport address)
-> srtt resultAnd last but not least, this one hands you the SRTT report for the destination address you ask about 🌟
Okay bestie, the local SCTP can report its latest SRTT on a destination, and it hands back an integer in milliseconds ✨📏 Here's the setup:
Mandatory attributes:
association id- local handle to the SCTP association 🎀destination transport address- the transport address of the association where the SRTT measurement is to be reported 💖
L) Set Failure Threshold 🔧
Format: SETFAILURETHRESHOLD(association id, destination transport
address, failure threshold)
-> resultThis one lets the local SCTP customize the reachability failure detection threshold Path.Max.Retrans for a specific destination address. It's giving "tune it to your vibe" 🎚️✨
Mandatory attributes:
association id- local handle to the SCTP association 🦋destination transport address- the transport address of the association where the failure detection threshold is to be set 🌸failure threshold- the new value ofPath.Max.Retransfor the destination address 💜
M) Set Protocol Parameters 🧁
Format: SETPROTOCOLPARAMETERS(association id, [,destination transport
address,] protocol parameter list)
-> resultThis primitive lets the local SCTP customize the protocol parameters. Main character energy 👑
Mandatory attributes:
association id- local handle to the SCTP association 💅protocol parameter list- the specific names and values of the protocol parameters (e.g.,Association.Max.Retrans[see Section 14]) that the SCTP user wants to customize 🍓
Optional attributes:
destination transport address- some of the protocol parameters may be set on a per destination transport address basis 🌈
N) Receive unsent message 📥
Format: RECEIVE_UNSENT(data retrieval id, buffer address, buffer size
[,stream id] [, stream sequence number] [,partial flag]
[,payload protocol-id])data retrieval id- the identification passed to the ULP in the failure notification 🫶buffer address- the memory location the ULP indicated for storing the received message 🧺buffer size- the maximum size of data to be received, in bytes 📦
Optional attributes:
stream id- a return value, set to indicate which stream the data was sent to 🌊stream sequence number- a returned value indicating the stream sequence number associated with the message 🔢partial flag- if this returned flag is set to 1, then this message is a partial delivery of the whole message. When this flag is set, thestream idandstream sequence numberMUST accompany this receive. When this flag is set to 0, it indicates that no more deliveries will be received for this stream sequence number. 🚦payload protocol-id- the 32 bit unsigned integer that was sent to be sent to the peer, indicating the type of payload protocol of the received data 🏷️
O) Receive unacknowledged message 📨
Format: RECEIVE_UNACKED(data retrieval id, buffer address, buffer size,
[,stream id] [, stream sequence number] [,partial flag]
[,payload protocol-id])data retrieval id- the identification passed to the ULP in the failure notification 💌buffer address- the memory location the ULP indicated for storing the received message 🗂️buffer size- the maximum size of data to be received, in bytes 📏
Optional attributes:
stream id- a return value, set to indicate which stream the data was sent to 🌟stream sequence number- a returned value indicating the stream sequence number associated with the message 🧮partial flag- if this returned flag is set to 1, then this message is a partial delivery of the whole message. When this flag is set, thestream idandstream sequence numberMUST accompany this receive. When this flag is set to 0, it indicates that no more deliveries will be received for this stream sequence number. 🛑payload protocol-id- the 32 bit unsigned integer that was sent to be sent to the peer, indicating the type of payload protocol of the received data 🎟️
P) Destroy SCTP instance 💥
Format: DESTROY(local SCTP instance name)local SCTP instance name- the value that was passed to the application in the initialize primitive, indicating which SCTP instance to destroy 🪦✨
10.2 SCTP-to-ULP 📣
It is assumed that the operating system or application environment provides a means for the SCTP to asynchronously signal the ULP process. When SCTP does signal an ULP process, certain information is passed to the ULP 💬
IMPLEMENTATION NOTE: In some cases this may be done through a separate socket or error channel. 🔌
A) DATA ARRIVE notification 📬
SCTP shall invoke this notification on the ULP when a user message is successfully received and ready for retrieval 🥳
The following may be optionally be passed with the notification:
association id- local handle to the SCTP association 💜stream id- indicates which stream the data is received on 🌊
B) SEND FAILURE notification 💔
If a message can not be delivered, SCTP shall invoke this notification on the ULP 😭
The following may be optionally be passed with the notification:
association id- local handle to the SCTP association 🎀data retrieval id- an identification used to retrieve unsent and unacknowledged data 🔑cause code- indicating the reason of the failure, e.g., size too large, message life-time expiration, etc. 🧾context- optional information associated with this message (see D in Section 10.1) 🫧
C) NETWORK STATUS CHANGE notification 🚦
When a destination transport address is marked inactive (e.g., when SCTP detects a failure), or marked active (e.g., when SCTP detects a recovery), SCTP shall invoke this notification on the ULP 🔄
The following shall be passed with the notification:
association id- local handle to the SCTP association 🦋destination transport address- indicates the destination transport address of the peer endpoint affected by the change; 🌸new-status- indicates the new status 📊
D) COMMUNICATION UP notification 🎉
This notification is used when SCTP becomes ready to send or receive user messages, or when a lost communication to an endpoint is restored. Big comeback energy 🌈
IMPLEMENTATION NOTE: If the ASSOCIATE primitive is implemented as a blocking function call, the association parameters are returned as a result of the ASSOCIATE primitive itself. In that case, the COMMUNICATION UP notification is optional at the association initiator's side. 🧠
The following shall be passed with the notification:
association id- local handle to the SCTP association 💖status- indicates what type of event has occurred 🎬destination transport address list- the complete set of transport addresses of the peer 🗺️outbound stream count- the maximum number of streams allowed to be used in this association by the ULP 📤inbound stream count- the number of streams the peer endpoint has requested with this association (this may not be the same number asoutbound stream count). 📥
E) COMMUNICATION LOST notification 🥀
When SCTP loses communication to an endpoint completely (e.g., via Heartbeats) or detects that the endpoint has performed an abort operation, it shall invoke this notification on the ULP 🫥
The following shall be passed with the notification:
association id- local handle to the SCTP association 🎗️status- indicates what type of event has occurred; the status may indicate a failure OR a normal termination event occurred in response to a shutdown or abort request 🏁
The following may be passed with the notification:
data retrieval id- an identification used to retrieve unsent and unacknowledged data 🗝️last-acked- the TSN last acked by that peer endpoint; 📍last-sent- the TSN last sent to that peer endpoint; 📌
F) COMMUNICATION ERROR notification 🚨
When SCTP receives an ERROR chunk from its peer and decides to notify its ULP, it can invoke this notification on the ULP 🙈
The following can be passed with the notification:
association id- local handle to the SCTP association 💜error info- indicates the type of error and optionally some additional information received through the ERROR chunk. 🔍
G) RESTART notification 🔁
When SCTP detects that the peer has restarted, it may send this notification to its ULP 🌅
The following can be passed with the notification:
association id- local handle to the SCTP association 🦋
H) SHUTDOWN COMPLETE notification 🏁
When SCTP completes the shutdown procedures (section 9.2), this notification is passed to the upper layer 🎀
The following can be passed with the notification:
association id- local handle to the SCTP association 🫶
11. Security Considerations 🔐
11.1 Security Objectives 🛡️
As a common transport protocol designed to reliably carry time-sensitive user messages, such as billing or signaling messages for telephony services, between two networked endpoints, SCTP has the following security objectives. Protect the vibe ✨
- availability of reliable and timely data transport services 💖
- integrity of the user-to-user information carried by SCTP 🧷
11.2 SCTP Responses To Potential Threats 🚨
SCTP may potentially be used in a wide variety of risk situations. It is important for operator(s) of systems running SCTP to analyze their particular situations and decide on the appropriate counter-measures 🧐
Operators of systems running SCTP should consult [RFC2196] for guidance in securing their site 🏰
11.2.1 Countering Insider Attacks 🕵️♀️
The principles of [RFC2196] should be applied to minimize the risk of theft of information or sabotage by insiders. Such procedures include publication of security policies, control of access at the physical, software, and network levels, and separation of services 🔒
11.2.2 Protecting against Data Corruption in the Network 🧬
Where the risk of undetected errors in datagrams delivered by the lower layer transport services is considered to be too great, additional integrity protection is required. If this additional protection were provided in the application-layer, the SCTP header would remain vulnerable to deliberate integrity attacks. While the existing SCTP mechanisms for detection of packet replays are considered sufficient for normal operation, stronger protections are needed to protect SCTP when the operating environment contains significant risk of deliberate attacks from a sophisticated adversary. 🚨😱
In order to promote software code-reuse, to avoid re-inventing the wheel, and to avoid gratuitous complexity to SCTP, the IP Authentication Header [RFC2402] SHOULD be used when the threat environment requires stronger integrity protections, but does not require confidentiality 🛠️
A widely implemented BSD Sockets API extension exists for applications to request IP security services, such as AH or ESP from an operating system kernel. Applications can use such an API to request AH whenever AH use is appropriate 🎀
11.2.3 Protecting Confidentiality ✨
okay so, confidentiality 🔐 in most cases the actual risk is the signaling data payload, NOT the SCTP or lower-layer overhead bits. so if that's your situation, encrypting just the SCTP user data might be the move 💅 and like with the supplementary checksum service, user data encryption MAY be performed by the SCTP user application 🎀
or, the user application MAY use an implementation-specific API to ask for the IP Encapsulating Security Payload (ESP) [RFC2406] to handle confidentiality and integrity for it 🦋
now, especially for mobile users, confidentiality can also mean hiding IP addresses and ports 🙈 in that case ESP SHOULD be used instead of application-level confidentiality. and if ESP is protecting SCTP traffic, it MUST use an ESP cryptographic transform that includes cryptographic integrity protection, bc if there's a confidentiality threat there's also a strong integrity threat. no cap, that's a whole vibe 💀
whenever ESP is in use, application-level encryption is not generally required 🌸
and regardless of where confidentiality lives, ISAKMP [RFC2408] and the Internet Key Exchange (IKE) [RFC2409] SHOULD be used for key management 🔑
operators should check out [RFC2401] for more info on the security services available at and right above the Internet Protocol layer 🧚
11.2.4 Protecting against Blind Denial of Service Attacks 🙅♀️
a blind attack is one where the attacker can't intercept or otherwise see the content of the data flows going to and from the target SCTP node 👀 and blind denial of service attacks can look like flooding, masquerade, or improper monopolization of services. ugh, the worst 😭
11.2.4.1 Flooding 🌊
the goal of flooding is to cause loss of service and incorrect behavior at target systems by exhausting resources, interfering with legit transactions, and exploiting buffer-related software bugs 💥 flooding can target the SCTP node itself or resources in the intervening IP Access Links or the Internet. when those latter things are the target, flooding shows up as loss of network services, and it could even mean breaking through any firewalls in place 🧱
in general, protection against flooding starts at the equipment design level 🛠️ and that includes things like:
- avoiding committing limited resources before you've figured out the request for service is legitimate
- giving priority to finishing processing already in progress over accepting new work
- identifying and removing duplicate or stale queued requests for service.
- not responding to unexpected packets sent to non-unicast addresses.
network equipment should be able to generate an alarm and log if a suspicious increase in traffic happens 🚨 the log should include info like the identity of the incoming link and the source address(es) used, which helps the network or SCTP system operator take protective measures 🫶 and there should be procedures in place for the operator to act on those alarms if a clear pattern of abuse shows up 👑
the design of SCTP is resistant to flooding attacks, like, really resistant 💪 especially because of its four-way start-up handshake, its use of a cookie to defer committing resources at the responding SCTP node until the handshake is done, and its use of a Verification Tag to stop extraneous packets from being inserted into the flow of an established association 🦋
the IP Authentication Header and Encapsulating Security Payload might also be useful for cutting the risk of certain kinds of denial of service attacks 🌈
the Host Name feature in the INIT chunk could be used to flood a target DNS server 😩 a huge backlog of DNS queries, resolving the Host Name received in the INIT chunk to IP addresses, could be created by sending INITs to multiple hosts in a given domain. and an attacker could also do an indirect attack on a third party by sending tons of INITs to random hosts that contain the host name of the target 🙃 on top of the strain on DNS resources, this could also mean large numbers of INIT ACKs getting sent to the target 📬
one method to protect against this kind of attack is to verify that the IP addresses received from DNS include the source IP address of the original INIT ✅ if the list of IP addresses from DNS doesn't include the INIT's source IP address, the endpoint MAY silently discard the INIT. this last option won't protect against the attack on the DNS itself, so just know that 🫠
11.2.4.2 Blind Masquerade 🎭
masquerade can be used to deny service in a few ways:
- by tying up resources at the target SCTP node that the impersonated node has limited access to. like, the target node might, by policy, allow a maximum of one SCTP association with the impersonated SCTP node. the masquerading attacker could try to set up an association pretending to come from the impersonated node, so the real one can't do it when it actually needs to 😤
- by deliberately letting the impersonation get detected, which provokes counter-measures that lock the impersonated node out of the target SCTP node 🔒
- by interfering with an established association by inserting extraneous content, like a SHUTDOWN request 🛑
SCTP reduces the risk of blind masquerade attacks through IP spoofing by using the four-way startup handshake 🤝 man-in-the-middle masquerade attacks are covered in Section 11.3 below. because the initial exchange is memoryless, blind masquerade attacks don't trigger any lockout mechanism 🙌 plus, the INIT ACK containing the State Cookie gets sent back to the IP address it got the INIT from, so the attacker never receives the INIT ACK with the State Cookie in it 🕵️♀️ and SCTP protects against extraneous packets being inserted into an established association's flow with the Verification Tag 💜
logging received INIT requests and weird stuff like unexpected INIT ACKs might be considered as a way to spot patterns of hostile activity 👀 but the potential usefulness of that logging has to be weighed against the extra SCTP startup processing it adds, which makes the SCTP node more vulnerable to flooding attacks 😬 and logging is pointless without operating procedures to review and analyze the logs on a routine basis 📋
11.2.4.3 Improper Monopolization of Services 🐉
these attacks happen openly and legitimately from the attacker's side 😐 they go after fellow users of the target SCTP node or of the shared resources between the attacker and the target node. possible attacks include opening a huge number of associations between the attacker's node and the target, or transferring large volumes of info within a legitimately-established association 📦
policy limits should be put on the number of associations per adjoining SCTP node 🚧 and SCTP user applications should be able to detect large volumes of illegitimate or "no-op" messages within a given association, then either log or terminate the association based on local policy 🫡
11.3 Protection against Fraud and Repudiation 🧾
the goal of fraud is to get services without authorization and, specifically, without paying for them 💸 to pull that off, the attacker has to get the SCTP user application at the target SCTP node to provide the service while it accepts invalid billing data or fails to collect it. repudiation is a related problem 🙄 since it can happen as a deliberate act of fraud, or just because the repudiating party kept inadequate records of the service they got
potential fraud attacks include intercepting and misusing authorizing info like credit card numbers, blind masquerade and replay, and man-in-the-middle attacks that modify the packets passing through a target SCTP association in real time 🥲
the interception attack is countered by the confidentiality measures from Section 11.2.3 above 🔐
Section 11.2.4.2 describes how SCTP is resistant to blind masquerade attacks, thanks to the four-way startup handshake and the Verification Tag 💖 and together, the Verification Tag and TSN protect against blind replay attacks where the replay goes into an existing association 🔁
however, SCTP does NOT protect against man-in-the-middle attacks where the attacker can intercept and alter the packets sent and received in an association 😱 for example, the INIT ACK has enough info sent on the wire for an adversary in the middle to hijack an existing SCTP association. where there's a significant chance of such attacks, or where possible repudiation is an issue, the use of the IPSEC AH service is recommended to make sure both the integrity and the authenticity of the SCTP packets passed 🛡️
SCTP also provides no protection against attacks that come from at or beyond the SCTP node and happen within an existing association 🙅♀️ preventing those should be covered by appropriate security policies at the host site, as discussed in Section 11.2.1 📜
12. Recommended Transmission Control Block (TCB) Parameters 🎀
this section details a recommended set of parameters that should be contained within the TCB for an implementation 📝 it's for illustrative purposes only, so it should not be deemed as requirements on an implementation, or as an exhaustive list of all the parameters inside an SCTP TCB. each implementation may need its own additional parameters for optimization ✨
12.1 Parameters necessary for the SCTP instance 💅
Associations: A list of current associations and mappings to the data
consumers for each association. This may be in the
form of a hash table or other implementation dependent
structure. The data consumers may be process
identification information such as file descriptors,
named pipe pointer, or table pointers dependent on how
SCTP is implemented.
Secret Key: A secret key used by this endpoint to compute the MAC.
This SHOULD be a cryptographic quality random number
with a sufficient length. Discussion in [RFC1750] can
be helpful in selection of the key.
Address List: The list of IP addresses that this instance has bound.
This information is passed to one's peer(s) in INIT and
INIT ACK chunks.
SCTP Port: The local SCTP port number the endpoint is bound to.12.2 Parameters necessary per association (i.e. the TCB) ✨
okay bestie, the TCB is basically the association's whole brain 🧠💖 here's everything it has to keep track of:
Peer : Tag value to be sent in every packet and is received
Verification: in the INIT or INIT ACK chunk.
Tag :
My : Tag expected in every inbound packet and sent in the
Verification: INIT or INIT ACK chunk.
Tag :
State : A state variable indicating what state the association
: is in, i.e. COOKIE-WAIT, COOKIE-ECHOED, ESTABLISHED,
: SHUTDOWN-PENDING, SHUTDOWN-SENT, SHUTDOWN-RECEIVED,
: SHUTDOWN-ACK-SENT.Note: No "CLOSED" state is illustrated since if a association is "CLOSED" its TCB SHOULD be removed. 🙈
Peer : A list of SCTP transport addresses that the peer is
Transport : bound to. This information is derived from the INIT or
Address : INIT ACK and is used to associate an inbound packet
List : with a given association. Normally this information is
: hashed or keyed for quick lookup and access of the TCB.
Primary : This is the current primary destination transport
Path : address of the peer endpoint. It may also specify a
: source transport address on this endpoint.
Overall : The overall association error count.
Error Count :
Overall : The threshold for this association that if the Overall
Error : Error Count reaches will cause this association to be
Threshold : torn down.
Peer Rwnd : Current calculated value of the peer's rwnd.
Next TSN : The next TSN number to be assigned to a new DATA chunk.
: This is sent in the INIT or INIT ACK chunk to the peer
: and incremented each time a DATA chunk is assigned a
: TSN (normally just prior to transmit or during
: fragmentation).
Last Rcvd : This is the last TSN received in sequence. This value
TSN : is set initially by taking the peer's Initial TSN,
: received in the INIT or INIT ACK chunk, and
: subtracting one from it.
Mapping : An array of bits or bytes indicating which out of
Array : order TSN's have been received (relative to the
: Last Rcvd TSN). If no gaps exist, i.e. no out of order
: packets have been received, this array will be set to
: all zero. This structure may be in the form of a
: circular buffer or bit array.
Ack State : This flag indicates if the next received packet
: is to be responded to with a SACK. This is initialized
: to 0. When a packet is received it is incremented.
: If this value reaches 2 or more, a SACK is sent and the
: value is reset to 0. Note: This is used only when no
: DATA chunks are received out of order. When DATA chunks
: are out of order, SACK's are not delayed (see Section
: 6).
Inbound : An array of structures to track the inbound streams.
Streams : Normally including the next sequence number expected
: and possibly the stream number.
Outbound : An array of structures to track the outbound streams.
Streams : Normally including the next sequence number to
: be sent on the stream.
Reasm Queue : A re-assembly queue.
Local : The list of local IP addresses bound in to this
Transport : association.
Address :
List :
Association : The smallest PMTU discovered for all of the
PMTU : peer's transport addresses.12.3 Per Transport Address Data 🦋
for every destination transport address in the peer's address list (the one from the INIT or INIT ACK chunk), there's a whole bunch of data that needs to be kept track of, like:
Error count : The current error count for this destination.
Error : Current error threshold for this destination i.e.
Threshold : what value marks the destination down if Error count
: reaches this value.
cwnd : The current congestion window.
ssthresh : The current ssthresh value.
RTO : The current retransmission timeout value.
SRTT : The current smoothed round trip time.
RTTVAR : The current RTT variation.
partial : The tracking method for increase of cwnd when in
bytes acked : congestion avoidance mode (see Section 6.2.2)
state : The current state of this destination, i.e. DOWN, UP,
: ALLOW-HB, NO-HEARTBEAT, etc.
PMTU : The current known path MTU.
Per : A timer used by each destination.
Destination :
Timer :
RTO-Pending : A flag used to track if one of the DATA chunks sent to
this address is currently being used to compute a
RTT. If this flag is 0, the next DATA chunk sent to this
destination should be used to compute a RTT and this
flag should be set. Every time the RTT calculation
completes (i.e. the DATA chunk is SACK'd) clear this
flag.
last-time : The time this destination was last sent to. This can be
used : used to determine if a HEARTBEAT is needed.12.4 General Parameters Needed 💅
last but not least, the two queues:
Out Queue : A queue of outbound DATA chunks.
In Queue : A queue of inbound DATA chunks.13. IANA Considerations 🎀
this protocol will require port reservation like TCP for the use of "well known" servers within the Internet. all current TCP ports shall be automatically reserved in the SCTP port address space. new requests should follow IANA's current mechanisms for TCP. ✨
this protocol may also be extended through IANA in three ways:
- through definition of additional chunk types,
- through definition of additional parameter types, or
- through definition of additional cause codes within ERROR chunks
in the case where a particular ULP using SCTP desires to have its own ports, the ULP should be responsible for registering with IANA for getting its ports assigned. 🌸
13.1 IETF-defined Chunk Extension 🧚
the definition and use of new chunk types is an integral part of SCTP. so new chunk types are assigned by IANA through an IETF Consensus action as defined in [RFC2434]. 💜
the documentation for a new chunk code type must include the following information:
a) A long and short name for the new chunk type;
b) A detailed description of the structure of the chunk, which MUST conform to the basic structure defined in Section 3.2;
c) A detailed definition and description of intended use of each field within the chunk, including the chunk flags if any;
d) A detailed procedural description of the use of the new chunk type within the operation of the protocol.
the last chunk type (255) is reserved for future extension if necessary. 🍓
13.2 IETF-defined Chunk Parameter Extension 🌈
new chunk parameter type codes are assigned through an IETF Consensus action as defined in [RFC2434]. documentation of the chunk parameter MUST contain the following information:
a) Name of the parameter type.
b) Detailed description of the structure of the parameter field. This structure MUST conform to the general type-length-value format described in Section 3.2.1.
c) Detailed definition of each component of the parameter value.
d) Detailed description of the intended use of this parameter type, and an indication of whether and under what circumstances multiple instances of this parameter type may be found within the same chunk.
13.3 IETF-defined Additional Error Causes 🫶
additional cause codes may be allocated in the range 11 to 65535 through a Specification Required action as defined in [RFC2434]. provided documentation must include the following information:
a) Name of the error condition.
b) Detailed description of the conditions under which an SCTP endpoint should issue an ERROR (or ABORT) with this cause code.
c) Expected action by the SCTP endpoint which receives an ERROR (or ABORT) chunk containing this cause code.
d) Detailed description of the structure and content of data fields which accompany this cause code.
the initial word (32 bits) of a cause code parameter MUST conform to the format shown in Section 3.3.10, i.e.:
- first two bytes contain the cause code value
- last two bytes contain length of the Cause Parameter.
13.4 Payload Protocol Identifiers 👑
except for value 0, which is reserved by SCTP to indicate an unspecified payload protocol identifier in a DATA chunk, SCTP will not be responsible for standardizing or verifying any payload protocol identifiers. SCTP simply receives the identifier from the upper layer and carries it with the corresponding payload data. 🔥
the upper layer, i.e., the SCTP user, SHOULD standardize any specific protocol identifier with IANA if it is so desired. the use of any specific payload protocol identifier is out of the scope of SCTP. 💀
14. Suggested SCTP Protocol Parameter Values ⭐
the following protocol parameters are RECOMMENDED: 🩷
RTO.Initial - 3 seconds
RTO.Min - 1 second
RTO.Max - 60 seconds
RTO.Alpha - 1/8
RTO.Beta - 1/4
Valid.Cookie.Life - 60 seconds
Association.Max.Retrans - 10 attempts
Path.Max.Retrans - 5 attempts (per destination address)
Max.Init.Retransmits - 8 attempts
HB.interval - 30 secondsIMPLEMENTATION NOTE: The SCTP implementation may allow ULP to customize some of these protocol parameters (see Section 10). 🧁
Note: RTO.Min SHOULD be set as recommended above. ✨
15. Acknowledgements 💜
the authors wish to thank Mark Allman, R.J. Atkinson, Richard Band, Scott Bradner, Steve Bellovin, Peter Butler, Ram Dantu, R. Ezhirpavai, Mike Fisk, Sally Floyd, Atsushi Fukumoto, Matt Holdrege, Henry Houh, Christian Huitema, Gary Lehecka, Jonathan Lee, David Lehmann, John Loughney, Daniel Luan, Barry Nagelberg, Thomas Narten, Erik Nordmark, Lyndon Ong, Shyamal Prasad, Kelvin Porter, Heinz Prantner, Jarno Rajahalme, Raymond E. Reeves, Renee Revis, Ivan Arias Rodriguez, A. Sankar, Greg Sidebottom, Brian Wyld, La Monte Yarroll, and many others for their invaluable comments. the whole crew, iconic 🌈💖
16. Authors' Addresses 🎀
okay bestie, here are the humans who wrote this, with their phone numbers and emails 📞 (they're all real people with real jobs, so be nice if you email them 💌)
Randall R. Stewart
24 Burning Bush Trail.
Crystal Lake, IL 60012
USA
Phone: +1-815-477-2127
EMail: rrs@cisco.com
Qiaobing Xie
Motorola, Inc.
1501 W. Shure Drive, #2309
Arlington Heights, IL 60004
USA
Phone: +1-847-632-3028
EMail: qxie1@email.mot.com
Ken Morneault
Cisco Systems Inc.
13615 Dulles Technology Drive
Herndon, VA. 20171
USA
Phone: +1-703-484-3323
EMail: kmorneau@cisco.com
Chip Sharp
Cisco Systems Inc.
7025 Kit Creek Road
Research Triangle Park, NC 27709
USA
Phone: +1-919-392-3121
EMail: chsharp@cisco.com
Hanns Juergen Schwarzbauer
SIEMENS AG
Hofmannstr. 51
81359 Munich
Germany
Phone: +49-89-722-24236
EMail: HannsJuergen.Schwarzbauer@icn.siemens.de
Tom Taylor
Nortel Networks
1852 Lorraine Ave.
Ottawa, Ontario
Canada K1H 6Z8
Phone: +1-613-736-0961
EMail: taylor@nortelnetworks.com
Ian Rytina
Ericsson Australia
37/360 Elizabeth Street
Melbourne, Victoria 3000
Australia
Phone: +61-3-9301-6164
EMail: ian.rytina@ericsson.com
Malleswar Kalla
Telcordia Technologies
3 Corporate Place
PYA-2J-341
Piscataway, NJ 08854
USA
Phone: +1-732-699-3728
EMail: mkalla@telcordia.com
Lixia Zhang
UCLA Computer Science Department
4531G Boelter Hall
Los Angeles, CA 90095-1596
USA
Phone: +1-310-825-2695
EMail: lixia@cs.ucla.edu
Vern Paxson
ACIRI
1947 Center St., Suite 600,
Berkeley, CA 94704-1198
USA
Phone: +1-510-666-2882
EMail: vern@aciri.org17. References 📚
these are all the docs this spec leans on, so you know where to look when you want the full story 🧚
[RFC768] Postel, J. (ed.), "User Datagram Protocol", STD 6, RFC
768, August 1980.
[RFC793] Postel, J. (ed.), "Transmission Control Protocol", STD 7,
RFC 793, September 1981.
[RFC1123] Braden, R., "Requirements for Internet hosts - application
and support", STD 3, RFC 1123, October 1989.
[RFC1191] Mogul, J. and S. Deering, "Path MTU Discovery", RFC 1191,
November 1990.
[RFC1700] Reynolds, J. and J. Postel, "Assigned Numbers", STD 2, RFC
1700, October 1994.
[RFC1981] McCann, J., Deering, S. and J. Mogul, "Path MTU Discovery
for IP version 6", RFC 1981, August 1996.
[RFC1982] Elz, R. and R. Bush, "Serial Number Arithmetic", RFC 1982,
August 1996.
[RFC2026] Bradner, S., "The Internet Standards Process -- Revision
3", BCP 9, RFC 2026, October 1996.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2401] Kent, S. and R. Atkinson, "Security Architecture for the
Internet Protocol", RFC 2401, November 1998.
[RFC2402] Kent, S. and R. Atkinson, "IP Authentication Header", RFC
2402, November 1998.
[RFC2406] Kent, S. and R. Atkinson, "IP Encapsulating Security
Payload (ESP)", RFC 2406, November 1998.
[RFC2408] Maughan, D., Schertler, M., Schneider, M. and J. Turner,
"Internet Security Association and Key Management
Protocol", RFC 2408, November 1998.
[RFC2409] Harkins, D. and D. Carrel, "The Internet Key Exchange
(IKE)", RFC 2409, November 1998.
[RFC2434] Narten, T. and H. Alvestrand, "Guidelines for Writing an
IANA Considerations Section in RFCs", BCP 26, RFC 2434,
October 1998.
[RFC2460] Deering, S. and R. Hinden, "Internet Protocol, Version 6
(IPv6) Specification", RFC 2460, December 1998.
[RFC2581] Allman, M., Paxson, V. and W. Stevens, "TCP Congestion
Control", RFC 2581, April 1999.18. Bibliography 📖
extra reading for the nerdy side of you 🤓💜
[ALLMAN99] Allman, M. and Paxson, V., "On Estimating End-to-End
Network Path Properties", Proc. SIGCOMM'99, 1999.
[FALL96] Fall, K. and Floyd, S., Simulation-based Comparisons of
Tahoe, Reno, and SACK TCP, Computer Communications Review,
V. 26 N. 3, July 1996, pp. 5-21.
[RFC1750] Eastlake, D. (ed.), "Randomness Recommendations for
Security", RFC 1750, December 1994.
[RFC1950] Deutsch P. and J. Gailly, "ZLIB Compressed Data Format
Specification version 3.3", RFC 1950, May 1996.
[RFC2104] Krawczyk, H., Bellare, M. and R. Canetti, "HMAC: Keyed-
Hashing for Message Authentication", RFC 2104, March 1997.
[RFC2196] Fraser, B., "Site Security Handbook", FYI 8, RFC 2196,
September 1997.
[RFC2522] Karn, P. and W. Simpson, "Photuris: Session-Key Management
Protocol", RFC 2522, March 1999.
[SAVAGE99] Savage, S., Cardwell, N., Wetherall, D., and Anderson, T.,
"TCP Congestion Control with a Misbehaving Receiver", ACM
Computer Communication Review, 29(5), October 1999.Appendix A: Explicit Congestion Notification 🦋
okay so ECN is this optional thing from RFC 2481 (Ramakrishnan, K., Floyd, S., "Explicit Congestion Notification", RFC 2481, January 1999) that lets you spot congestion before packets start getting dropped. it's giving early warning system 🚨 an implementation MAY choose to add it to SCTP, and this appendix is just the list of little differences you need to know about. basically: follow RFC 2481, except for the bits below 💅
Negotiation
ngl, RFC 2481 does this whole dance during the SYN and SYN-ACK stages of a TCP connection. the SYN sender sets two bits, and the SYN-ACK sender only sets one, so both sides are truly sure they're ECN capable. SCTP doesn't need all that drama 🙄. to say "I'm ECN capable," an endpoint SHOULD add the reserved ECN TLV to its INIT and/or INIT ACK chunk. the TLV has no parameters, so it's just this tiny thing:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Parameter Type = 32768 | Parameter Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ECN-Echo
RFC 2481 has a specific bit the receiver sends back in its TCP acks to tell the sender "hey, I got a Congestion Experienced (CE) mark from the network." 👀 in SCTP, that same message is the ECNE chunk. it holds exactly one data element: the lowest TSN attached to the IP datagram that got the CE mark. it looks like this 🍓
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Chunk Type=12 | Flags=00000000| Chunk Length = 8 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Lowest TSN Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Note: The ECNE is considered a Control chunk. 🫶
CWR
in RFC 2481, the sender sets a specific bit in the header of its next outbound TCP segment to tell its peer "I've shrunk my congestion window." that's the CWR bit. for SCTP, the same signal is the CWR chunk, which again has one data element: the TSN that was sent in the ECNE chunk. that's the lowest TSN in the datagram that originally got the CE mark. ✨
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Chunk Type=13 | Flags=00000000| Chunk Length = 8 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Lowest TSN Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Note: The CWR is considered a Control chunk. 🌸
Appendix B Alder 32 bit checksum calculation 🧮
this checksum math is copied straight from [RFC1950] 💅. here's the deal: Adler-32 is two running sums, updated byte by byte. s1 is the sum of all the bytes, and s2 is the sum of all the s1 values. both sums are taken modulo 65521. s1 starts at 1 and s2 starts at 0. the final checksum gets stored as s2*65536 + s1 in network byte order 🌈
the C code below computes the Adler-32 checksum of a data buffer. it's written to be clear, not fast, so don't panic if it looks slow 🙈. it's ANSI C, but if you're not a C person, these hints should help:
&is the bitwise AND operator.>>is the bitwise right shift operator. on an unsigned quantity, like here, right shift inserts zero bit(s) on the left.<<is the bitwise left shift operator. left shift inserts zero bit(s) on the right.++means "n++" increments the variable n.%is the modulo operator: a % b is the remainder of a divided by b.
#define BASE 65521 /* largest prime smaller than 65536 */
/*
Update a running Adler-32 checksum with the bytes buf[0..len-1]
and return the updated checksum. The Adler-32 checksum should be
initialized to 1.
Usage example:
unsigned long adler = 1L;
while (read_buffer(buffer, length) != EOF) {
adler = update_adler32(adler, buffer, length);
}
if (adler != original_adler) error();
*/
unsigned long update_adler32(unsigned long adler,
unsigned char *buf, int len)
{
unsigned long s1 = adler & 0xffff;
unsigned long s2 = (adler >> 16) & 0xffff;
int n;
for (n = 0; n < len; n++) {
s1 = (s1 + buf[n]) % BASE;
s2 = (s2 + s1) % BASE;
}
return (s2 << 16) + s1;
}
/* Return the adler32 of the bytes buf[0..len-1] */
unsigned long adler32(unsigned char *buf, int len)
{
return update_adler32(1L, buf, len);
}Full Copyright Statement ⚖️
okay the legal bit, but make it cute 🎀. the Internet Society (2000) owns the copyright, and all rights are reserved. you're allowed to copy this document and share it with others, and you can make derivative works that comment on or explain it, or help with implementing it. you can publish and distribute those, in whole or in part, with no restrictions of any kind. the one catch: the copyright notice and this paragraph have to stay on all those copies and derivative works. the document itself can't be modified in any way, like removing the copyright notice or the references to the Internet Society or other Internet organizations. the exceptions are when it's needed for developing Internet standards (in which case you follow the copyright procedures in the Internet Standards process), or when it's being translated into languages other than English 🌍.
the permissions above are perpetual, and the Internet Society or its successors or assigns will never revoke them 💖.
this document and the information in it is provided on an "AS IS" basis, and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE 🫠.
Acknowledgement 🫶
okay so the last bit of the doc is a little thank-you note 💖 The RFC Editor function is currently funded by the Internet Society 🌸 That's the group that keeps the whole RFC publishing machine running, so bestie, give them some love ✨
📦 where this page comes from
- ietf: rfc2960 2000-10
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms