RFC 4436

Detecting Network Attachment in IPv4 (DNAv4)

📅 published March 2006, from ietf

Detecting Network Attachment in IPv4 (DNAv4) 🦋

Okay bestie, this is RFC 4436, and it's a Standards Track doc, so it's an actual official protocol spec. 💅 It's from the Network Working Group and it's Request for Comments: 4436. The authors are B. Aboba (Microsoft Corporation), J. Carlson (Sun Microsystems), and S. Cheshire (Apple Computer). It's dated March 2006. It doesn't list anything it obsoletes or updates, so it's standing on its own. 🌸

Status of This Memo

This document specifies an Internet standards track protocol for the Internet community, and it's asking for discussion and suggestions for improvements ✨ If you want to know where this protocol stands officially, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited 🫶

Copyright Notice

Abstract

Okay so, detecting that you've moved to a new network and then getting (or continuing to use) an IPv4 configuration can take a seriously big chunk of the total handover latency when you switch between points of attachment 😭 This document pulls together lessons from deploying hosts that support ARP, DHCP, and IPv4 Link-Local addresses. The result is a set of steps called Detecting Network Attachment for IPv4 (DNAv4), and its whole goal is to cut down that handover latency 🔥

   1. Introduction ....................................................2
      1.1. Applicability ..............................................2
      1.2. Requirements ...............................................5
      1.3. Terminology ................................................5
   2. Overview ........................................................6
      2.1. Reachability Test ..........................................8
           2.1.1. Packet Format .......................................9
      2.2. IPv4 Address Acquisition ..................................10
      2.3. IPv4 Link-Local Addresses .................................11
      2.4. Manually Assigned Addresses ...............................12
   3. Security Considerations ........................................12
   4. References .....................................................13
      4.1. Normative References ......................................13
      4.2. Informative References ....................................13
   5. Acknowledgements ...............................................14

1. Introduction ✨

Okay, so the time it takes to notice you've moved between networks, and then to get (or keep using) a working IPv4 configuration, can be a really big slice of the total handover latency when you change points of attachment 🥺

This document is built from real deployment experience with hosts that support ARP [RFC826], DHCP [RFC2131], and IPv4 Link-Local addresses [RFC3927]. The steps it describes are called Detecting Network Attachment for IPv4 (DNAv4) 💜 DNAv4 is all about the common case of reattaching to a network you've already been on. It tries to reuse a previous configuration that's still valid, which cuts the reattachment time on LANs down to a few milliseconds ⚡ Because it depends on the ARP protocol, it's not suitable for media that don't support ARP 🙈

1.1. Applicability

DHCP is honestly the main character of host address assignment 👑 It's effective and widely adopted for getting an IP address for a particular network link. It can also re-validate a previously obtained address using DHCP's INIT-REBOOT mechanism [RFC2131] 🧚

When you're getting a brand-new address, DHCP says the client SHOULD use ARP to check that the offered address isn't already in use 🫣 This is called address conflict detection [ACD], and it can take as long as seven seconds. In theory you could shorten that window, but there's an obvious tradeoff: the less time a host waits to see whether someone else is already using its intended address, the higher the risk of an accidental address conflict 💀

If the client successfully re-validates a previously obtained address with INIT-REBOOT, the DHCP specification does not require the client to do address conflict detection. So that seven-second delay doesn't apply here 🙌 The catch is that the DHCP server might be slow to respond, or it might be down and not responding at all. That's why hosts could really benefit from a quicker way to figure out that a previously obtained address is still valid on this particular link 🍓

When a client moves between networks, the address re-validation attempt might not work out. A DHCPNAK can come back in response to a DHCPREQUEST, and that makes the client restart the configuration process by moving to the INIT state 😤 But if an address it got earlier on the new network is still operable, DNAv4 lets the host confirm the new configuration quickly. No restarting the whole configuration process, and no conflict detection needed 🦋

The alternative mechanism in this document applies when a host has a previously allocated DHCP address. That address was never given back to the DHCP server with a DHCPRELEASE message, and it still has time left on its lease 🎀 In that situation, the host can figure out whether it's reattached to the logical link where that address is valid. It does this by sending a unicast ARP Request packet to a router it previously knew for that link. If the link has more than one router, it can send one or more unicast ARP Request packets to one or more of those routers 💅

Unicast ARP has a bunch of perks. First, unicast packets put less burden on the network than broadcast packets. That matters a lot on 802.11 networks, where broadcast packets might be sent at rates as low as 1 Mb/sec 📶 Second, if the host isn't on the link it hoped to be on, a broadcast ARP Request could pollute the ARP caches of peers on that link. Third, when you're using private addresses [RFC1918], some other device could legitimately be using the same address. A broadcast ARP Request could mess with its communications, breaking TCP connections and causing similar problems 😭 And finally, a unicast ARP packet addressed to the MAC address of the router the host expects to find means that if the host isn't on the expected link, nobody has that MAC address. The ARP packet just harmlessly disappears into the void without doing any damage 🕳️✨

Okay, so all these applicability issues lead to a few conclusions:

DNAv4 is a performance optimization. Its job is to speed up a process that can take as much as a few hundred milliseconds (DHCP INIT-REBOOT), and to cut down the multi-second conflict detection delays when a host changes networks 🚀
As a performance optimization, it must not sacrifice correctness. In other words, false positives are not acceptable. DNAv4 must not conclude that a host has returned to a previously visited link where it has an operable IP address if that's not actually the case 🙅‍♀️
As a performance optimization, false negatives are acceptable. It's not an absolute requirement that this optimization correctly recognize a previously visited link in every possible case. For example, if a router ignores unicast ARP Requests, then DNAv4 won't be able to detect that it has returned to the same link in the future. That's okay, because the host still operates correctly like it did without DNAv4, just without the performance benefit. Users and network operators who want the performance improvement that DNAv4 offers can upgrade their routers to support DNAv4 🌈
As a performance optimization, where DNAv4 fails to provide a benefit, it should add little or no delay compared to today's DHCP processing. In practice, this means DHCP processing needs to proceed in parallel. Waiting for DNAv4 to fail before starting DHCP processing can greatly increase total processing time, which is the exact opposite of what we want 😩
Trials are inexpensive. DNAv4 does its checks using small unicast packets. An IPv4 ARP packet on Ethernet is just 42 octets, including the Ethernet header. So the cost of an unsuccessful attempt is small, while the cost of a missed opportunity (having the right address available as a candidate and choosing not to try it for some reason) is large. Because of that, the best strategy is often to try all available candidate configurations, instead of trying to figure out which candidates, if any, might be correct for this link using heuristics or hints. For a heuristic to be a potentially useful way to eliminate inappropriate configurations from the candidate list, it has to (a) be fast and cheap to compute compared to sending a 42-octet unicast packet, and (b) have a high probability of not falsely eliminating a candidate configuration that could turn out to be the correct one 🧠
Time is limited. If DNAv4 is going to be effective at enabling low-latency handoffs, it needs to complete in less than 10 ms ⏱️ That means any heuristic used to eliminate candidate configurations needs to take at most a few milliseconds to compute. There isn't much room for heuristics based on observing link-layer or Internet-layer traffic 🥲

1.2. Requirements

Okay, this part is the rulebook for the spec 📜 In this document, several words signify the requirements of the specification. The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" are to be interpreted as described in "Key words for use in RFCs to Indicate Requirement Levels" [RFC2119] 🫶

1.3. Terminology 🦋

okay so before we get into the good stuff, let's make sure we're all speaking the same language, bestie 💅

ar$sha ARP packet field: Sender Hardware Address [RFC826]. The hardware (MAC) address of the originator of an ARP packet.

ar$spa ARP packet field: Sender Protocol Address [RFC826]. For IP Address Resolution, this is the IPv4 address of the sender of the ARP packet.

ar$tha ARP packet field: Target Hardware Address [RFC826]. The hardware (MAC) address of the target of an ARP packet.

ar$tpa ARP packet field: Target Protocol Address [RFC826]. For IPv4 Address Resolution, the IPv4 address for which one desires to know the hardware address.

DHCP client A DHCP client or "client" is an Internet host using the Dynamic Host Configuration Protocol (DHCP) [RFC2131] to obtain configuration parameters, such as a network address.

DHCP server A DHCP server or "server" is an Internet host that returns configuration parameters to DHCP clients.

Link A communication facility or medium over which network nodes can communicate. Each link is associated with a minimum of two endpoints. Each link endpoint has a unique link-layer identifier.

Link Down An event provided by the link layer that signifies a state change associated with the interface's no longer being capable of communicating data frames; transient periods of high frame loss are not sufficient. DNAv4 does not utilize "Link Down" indications.

Link Layer Conceptual layer of control or processing logic that is responsible for maintaining control of the data link. The data link layer functions provide an interface between the higher-layer logic and the data link. The link layer is the layer immediately below IP.

Link Up An event provided by the link layer that signifies a state change associated with the interface's becoming capable of communicating data frames.

Point of Attachment The link endpoint on the link to which the host is currently connected.

Routable address In this specification, the term "routable address" refers to any unicast IPv4 address other than an IPv4 Link-Local address. This includes private addresses as specified in "Address Allocation for Private Internets" [RFC1918].

Operable address In this specification, the term "operable address" refers either to a static IPv4 address, or an address assigned via DHCPv4 that has not been returned to the DHCP server via a DHCP RELEASE message, and whose lease has not yet expired.

2. Overview ✨

okay so this is the big picture, and it's giving main character energy 🎀

On connecting to a new point of attachment, the host responds to a "Link Up" indication from the link layer by carrying out the DNAv4 procedure.

For each network that it connects to, it is assumed that the host saves the following parameters to stable storage:

[1] The IPv4 and MAC address of one or more test nodes on the network.

[2] The IPv4 configuration parameters, including the DHCP client identifier, assigned address, and lease expiration time.

From the set of networks that have operable IPv4 addresses associated with them, the host selects a subset and attempts to confirm the configuration for each network, using the reachability test described in Section 2.1.

For a particular network, the host SHOULD use the addresses of local routers (preferably default gateways) as its test nodes. If more than one address is known, those addresses may be tested in parallel. In order to ensure configuration validity, the host SHOULD only configure routes for which the next hop address passes the reachability test. Other routes SHOULD be re-learned. 🫶

DNAv4 does not significantly increase the likelihood of an address conflict. The reachability test is only carried out for a network when the host has previously completed conflict detection as recommended in Section 2.2 of the DHCP specification [RFC2131] and obtained an operable IPv4 configuration on that network. Restrictions on sending ARP Requests and Responses are described in Section 2.1.1.

One case where DNAv4 does increase the likelihood of an address conflict is when:

o a DHCP server hands out an address lease,

o the host with that lease leaves the network,

o the DHCP server is power-cycled or crashes and is rebooted,

o the DHCP server, having failed to save leases to stable storage, assigns that same address to another host, and

o the first host returns and, having a still-valid lease with time remaining, proceeds to use its assigned address, conflicting with the new host that is now using that same address.

While Section 4 of the DHCP specification [RFC2131] assumes that DHCP servers save their leases in persistent storage, almost no consumer-grade NAT gateway does so. Short DHCP lease lifetimes can mitigate this risk, though this also limits the operable candidate configurations available for DNAv4 to try. 💀

2.1. Reachability Test 🔥

The host skips the reachability test for a network if any of the following conditions are true:

[a] The host does not have an operable routable IPv4 address on that network. In this case, the reachability test cannot confirm that the host has an operable routable IPv4 address, so completing the reachability test would serve no purpose.

[b] The host does not know the addresses of any test nodes on that network. In this case, insufficient information is available to carry out the reachability test.

[c] If DHCP authentication [RFC3118] is configured. The reachability test utilizes ARP, which is insecure. Hosts that have been configured to attempt DHCP authentication SHOULD NOT utilize the reachability test. Security issues are discussed in Section 4.

[d] The contents of the DHCP Client Identifier option that the client used to obtain the candidate configuration is different from the DHCP Client Identifier option the client intends to present on the interface in question. In this case, it is anticipated that a DHCP server would NAK any request made by the client to acquire or extend the candidate configuration, since the two interfaces are presenting differing identities.

If the reachability test is successful, the host SHOULD continue to use the operable routable IPv4 address associated with the confirmed network, without needing to re-acquire it. Once a valid reachability test response is received, validation is complete, and additional responses should be discarded.

If a DHCPv4 client is operational, it is RECOMMENDED that the host attempt to obtain IPv4 configuration via DHCPv4 in parallel with the reachability tests, with the host using the first answer returned. This ensures that the DNAv4 procedure will not result in additional delay in the case where reachability tests fail, or where sending a DHCPREQUEST from the INIT-REBOOT state, as described in Section 3.2 and 4.3.2 of the DHCP specification [RFC2131], completes more quickly than the reachability tests.

In situations where both DNAv4 and DHCP are used on the same link, it is possible that the reachability test will complete successfully, and then DHCP will complete later with a different result. If this happens, the implementation SHOULD abandon the reachability test results and use the DHCP result instead, unless the address confirmed via the reachability test has been manually assigned (see Section 2.4).

Where the reachability test does not return an answer, this is typically because the host is not attached to the network whose configuration is being tested. In such circumstances, there is typically little value in aggressively retransmitting reachability tests that do not elicit a response.

Where DNAv4 and DHCP are tried in parallel, one strategy is to forsake reachability test retransmissions and to allow only the DHCP client to retransmit. In order to reduce competition between DNAv4 and DHCP retransmissions, a DNAv4 implementation that retransmits may utilize the retransmission strategy described in Section 4.1 of the DHCP specification [RFC2131], scheduling DNAv4 retransmissions between DHCP retransmissions.

If a response is received to any reachability test or DHCP message, pending retransmissions are canceled. It is RECOMMENDED that a DNAv4 implementation retransmit no more than twice. To provide damping in the case of spurious "Link Up" indications, it is RECOMMENDED that the DNAv4 procedure be carried out no more than once a second. ✨

2.1.1. Packet Format 🧚

The reachability test is performed by sending a unicast ARP Request. The host MUST set the target protocol address (ar$tpa) to the IPv4 address of the node being tested, and the sender protocol address field (ar$spa) to its own candidate IPv4 address. The ARP Request MUST use the host MAC address as the source, and the test node MAC address as the destination. The host includes its MAC address in the sender hardware address field (ar$sha) and sets the target hardware address field (ar$tha) to 0.

If a valid ARP Reply is received, the MAC address in the sender hardware address field (ar$sha) in the ARP Reply is matched against the target hardware address field (ar$tpa) in the ARP Request, and the IPv4 address in the sender protocol address field (ar$spa) of the ARP Reply is matched against the target protocol address field (ar$tpa) in the ARP Request. If a match is found, then the host continues to use that IPv4 address, subject to the lease re-acquisition and expiration behavior described in Section 4.4.5 of the DHCP specification [RFC2131].

The risk of an address conflict is greatest when the host moves between private networks, since in this case the completion of conflict detection on the former network does not provide assurance against an address conflict on the new network. Until a host has confirmed the operability of its IPv4 configuration by receipt of a response to the reachability test, it SHOULD NOT respond to ARP Requests and SHOULD NOT broadcast ARP Requests containing its address within the sender protocol address field (ar$spa).

Sending an ICMP Echo Request [RFC792] would not be an acceptable way of testing a candidate configuration, since sending any IP packet generally requires an ARP Request/Reply exchange and, as explained above, ARP packets may not be broadcast safely until after the candidate configuration has been confirmed. Also, where a host moves from one private network to another, an ICMP Echo Request can result in an ICMP Echo Response even when the MAC address has changed, as long as the IPv4 address remains the same. This can occur, for example, where a host moves from one home network using prefix 192.168/16 to another one. In addition, if the ping is sent with TTL > 1, then an ICMP Echo Response can be received from an off-link router. As a result, if the MAC address of the test node is not checked, the host can mistakenly confirm attachment, potentially resulting in an address conflict. As a result, sending an ICMP Echo Request SHOULD NOT be used as a substitute for the reachability test. 🙈

2.2. IPv4 Address Acquisition ✨

Okay so, if the host already has a working routable IPv4 address on one or more networks AND DHCPv4 is turned on for that interface, the host SHOULD go grab an IPv4 config with DHCPv4 🎀, and it does this at the same time as one or more reachability tests 🦋. The move is to enter the INIT-REBOOT state and send a DHCPREQUEST to the broadcast address, as spelled out in Section 4.4.2 of the DHCP spec [RFC2131] 💅.

If the host doesn't have an operable routable IPv4 address on ANY network, it enters the INIT state and sends a DHCPDISCOVER packet to the broadcast address, as described in Section 4.4.1 of the DHCP spec [RFC2131] 🌸. If the host supports the Rapid Commit Option [RFC4039], the exchange can get shortened from a 4-message exchange to a 2-message exchange, which is giving efficiency 🧚.

If the host doesn't get a response to a DHCPREQUEST or DHCPDISCOVER, it retransmits as specified in Section 4.1 of the DHCP spec [RFC2131] 🍓.

Here's the tea ☕. As discussed in Section 4.4.4 of the DHCP spec [RFC2131], a host in the INIT or REBOOTING state that already knows a DHCP server's address may use that address in the DHCPDISCOVER or DHCPREQUEST instead of the IPv4 broadcast address. In the INIT-REBOOT state though, the DHCPREQUEST goes to the broadcast address so the host gets a response no matter whether the previously configured IPv4 address is correct for the network it just connected to 🙈.

Sending a DHCPREQUEST to a unicast address in INIT-REBOOT state is NOT the move 🚫. If the DHCP client has moved to another subnet, the server's response can't be routed back, because the DHCPREQUEST bypasses the DHCP relay and contains an invalid source address 💀.

2.3. IPv4 Link-Local Addresses

Okay this one is lowkey important 👀. DNAv4 only applies to previously configured addresses that had some lease lifetime attached, and during that lifetime the address can legitimately be treated as reserved for exclusive use by the host it was assigned to. DHCP-assigned addresses fit that description 🎀. IPv4 Link-Local addresses [RFC3927] do NOT fit, because they aren't handed out by an authoritative server and don't come with any guaranteed usable lifetime 😭.

A host's claim on an IPv4 Link-Local address is only valid as long as that host stays connected to the link and is actively defending against probes for its chosen address 🛡️. The second a host shuts down, sleeps, or otherwise disconnects from a link, it immediately gives up any claim it might have had on any IPv4 Link-Local address on that link 🌙. So a host that wants to reclaim a previously used IPv4 Link-Local address MUST perform the full probing and announcement process required by "Dynamic Configuration of IPv4 Link-Local Addresses" [RFC3927], and it MUST NOT try to use DNAv4 as a shortcut to skip that process 🚷. Not allowed, bestie.

Where the host doesn't have an operable routable IPv4 address on any network, the host MAY configure an IPv4 Link-Local address before it enters the INIT state and sends a DHCPDISCOVER packet, as described in Section 2.3 of the DHCP spec [RFC2131] ✨. And where a host can confirm it's still connected to a network on which it has an operable routable IPv4 address, that address should be used, and the IPv4 Link-Local address is deprecated, as noted in Section 1.9 of the IPv4 Link-Local specification [RFC3927] 🌈.

Last bit of this section, and it's a bit of a plot twist 🎭. Where a host has an operable routable IPv4 address on one or more networks, but the reachability test can't confirm the configuration and the DHCPv4 client doesn't get a response after using the retransmission algorithm, Section 3.2 of the DHCP spec [RFC2131] says the client MAY choose to use the previously allocated network address and configuration parameters for the rest of the unexpired lease 🍯.

2.4. Manually Assigned Addresses

An implementation can use DNAv4 to confirm the configuration of manually assigned addresses 🧐. BUT, and this is a big but 🫣, special consideration is needed for that to produce reliable results, so it SHOULD NOT be enabled by default 🙅‍♀️.

For DNAv4 purposes, manually assigned addresses may be treated as equivalent to DHCP-assigned addresses with an infinite lifetime 💜. This doesn't significantly raise the chance of an address conflict as long as the manually assigned address is reserved by the DHCP server or sits outside the scope of addresses the DHCP server hands out 🌸. Here's where it gets messy 🌀: if the manually assigned address IS inside an address scope the DHCP server uses, the host might be unavailable when the DHCP server checks for a conflict before assigning that same address to someone else. In that case, a host using DNAv4 could confirm an address that was actually assigned to another host 😱.

Typically, an address gets manually assigned because a dynamically assigned address wasn't suitable for some reason 🤷‍♀️. So when DNAv4 and DHCP run in parallel and DNAv4 confirms a manual configuration, it may be undesirable to let DHCP override that configuration, as described in Section 2.1 🙅. However, packet loss can make the reachability test fail while DHCP still completes successfully, and then the host ends up with a dynamic address when it wanted a static one 😤. To reliably reconfirm manually assigned addresses, reachability tests for manual configurations need a more aggressive retransmission strategy than the one in Section 4.1 of the DHCP spec [RFC2131] 💪. For example, shorter retransmission intervals and more persistent retransmissions may be required ⏱️.

3. Security Considerations 🔐

Okay, security time, and this one is SERIOUS 🚨. Detecting Network Attachment for IPv4 (DNAv4) is based on ARP and DHCP, so it inherits the security vulnerabilities of both of those protocols 💀.

ARP [RFC826] traffic isn't secured 😬. So an attacker who gets access to the network can spoof a response to the reachability test described in Section 2.1, and that tricks the querier into falsely concluding it's attached to a network it isn't actually connected to 🎭.

Same energy with DHCPv4. Where DHCPv4 traffic isn't secured, an attacker could masquerade as a DHCPv4 server to convince the host that it's attached to a particular network 👻. This and other DHCPv4 threats are described in "Authentication for DHCP Messages" [RFC3118] 📖.

Here's the real danger zone ⚠️. The effect of these attacks will typically be limited to denial of service, UNLESS the host uses its IP configuration for other stuff, like security configuration or location determination 🙀. For example, a host that disables its personal firewall based on evidence that it attached to a home network could get compromised by spoofing the DNAv4 reachability test 🔥. In general, adjusting the security configuration based on DNAv4 is NOT RECOMMENDED 🙅‍♀️.

Hosts that depend on secure IP configuration SHOULD NOT use DNAv4 🚫. Instead they SHOULD utilize DHCP authentication [RFC3118], possibly in combination with the Rapid Commit Option [RFC4039] 🔒✨.

4. References 📚

4.1. Normative References

[RFC826]  Plummer, D., "Ethernet Address Resolution Protocol: Or
          converting network protocol addresses to 48.bit Ethernet
          address for transmission on Ethernet hardware", STD 37, RFC
          826, November 1982.

[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
          Requirement Levels", BCP 14, RFC 2119, March 1997.

[RFC2131] Droms, R., "Dynamic Host Configuration Protocol", RFC 2131,
          March 1997.

4.2. Informative References

[ACD]     Cheshire, S., "IPv4 Address Conflict Detection", Work in
          Progress, July 2005.

[RFC792]  Postel, J., "Internet Control Message Protocol", STD 5, RFC
          792, September 1981.

[RFC1918] Rekhter, Y., Moskowitz, B., Karrenberg, D., de Groot, G.,
          and E. Lear, "Address Allocation for Private Internets",
          BCP 5, RFC 1918, February 1996.

[RFC3118] Droms, R. and W. Arbaugh, "Authentication for DHCP
          Messages", RFC 3118, June 2001.

[RFC3927] Cheshire, S., Aboba, B., and E. Guttman, "Dynamic
          Configuration of IPv4 Link-Local Addresses", RFC 3927, May
          2005.

[RFC4039] Park, S., Kim, P., and B. Volz, "Rapid Commit Option for
          the Dynamic Host Configuration Protocol version 4
          (DHCPv4)", RFC 4039, March 2005.

5. Acknowledgements 🫶

The authors would like to acknowledge Greg Daley of Monash University, Erik Guttman and Erik Nordmark of Sun Microsystems, Ralph Droms of Cisco Systems, Ted Lemon of Nominum, John Loughney of Nokia, Thomas Narten of IBM and David Hankins of ISC for contributions to this document. Iconic cast, honestly 👑.

Authors' Addresses 📮

Bernard Aboba
Microsoft Corporation
One Microsoft Way
Redmond, WA 98052

Phone: +1 425 818 4011
Fax:   +1 425 936 7329
EMail: bernarda@microsoft.com


James Carlson
Sun Microsystems, Inc
1 Network Drive
Burlington, MA  01803-2757
USA

Phone: +1 781 442 2084
Fax:   +1 781 442 1677
EMail: james.d.carlson@sun.com


Stuart Cheshire
Apple Computer, Inc.
1 Infinite Loop
Cupertino, California 95014, USA

Phone: +1 408 974 3207
EMail: rfc@stuartcheshire.org

This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.

This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Intellectual Property 🧾

The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79.

Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr.

The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org.

Acknowledgement 💖

Funding for the RFC Editor function is provided by the IETF Administrative Support Activity (IASA). That's the end, bestie 🦋✨

📦 where this page comes from

ietf: rfc4436 2006-03
💖 girlified by claude-haiku-5-5 on 2026-10-16: a language model's rewrite of the original, under its terms