RFC 4960
Stream Control Transmission Protocol
RFC 4960: Stream Control Transmission Protocol 🦋
Okay bestie, let's get into it! ✨ This is RFC 4960, titled Stream Control Transmission Protocol. It's a Standards Track document from September 2007, edited by R. Stewart (Ed.) under the Network Working Group. It obsoletes RFC 2960 and RFC 3309 💅, so if you're still reading those, it's time to upgrade bestie 🎀.
Status of This Memo 🌸
This document specifies an Internet standards track protocol for the Internet community, and it requests discussion and suggestions for improvements 💜. For the standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1) 🔥. Distribution of this memo is unlimited 🌈.
Abstract ✨
So the abstract says this document obsoletes RFC 2960 and RFC 3309, and it describes the Stream Control Transmission Protocol (SCTP) 🦋. SCTP was designed to carry Public Switched Telephone Network (PSTN) signaling messages over IP networks, but it's giving "capable of so much more" 👑.
SCTP is a reliable transport protocol that runs on top of a connectionless packet network like IP 🧚. It offers these services to its users:
- acknowledged error-free non-duplicated transfer of user data 💖,
- data fragmentation to conform to discovered path MTU size 🍓,
- sequenced delivery of user messages within multiple streams, with an option for order-of-arrival delivery of individual user messages 🌈,
- optional bundling of multiple user messages into a single SCTP packet, and 🫶
- network-level fault tolerance through supporting multi-homing at either or both ends of an association 💅.
The design of SCTP includes appropriate congestion avoidance behavior and resistance to flooding and masquerade attacks 🔥. Iconic, honestly 😭.
part 1 of 34, more coming soon bestie 💜
Table of Contents 🎀
1. Introduction ....................................................5
1.1. Motivation .................................................5
1.2. Architectural View of SCTP .................................6
1.3. Key Terms ..................................................6
1.4. Abbreviations .............................................10
1.5. Functional View of SCTP ...................................10
1.5.1. Association Startup and Takedown ...................11
1.5.2. Sequenced Delivery within Streams ..................12
1.5.3. User Data Fragmentation ............................12
1.5.4. Acknowledgement and Congestion Avoidance ...........12
1.5.5. Chunk Bundling .....................................13
1.5.6. Packet Validation ..................................13
1.5.7. Path Management ....................................13
1.6. Serial Number Arithmetic ..................................14
1.7. Changes from RFC 2960 .....................................15
2. Conventions ....................................................15
3. SCTP Packet Format .............................................15
3.1. SCTP Common Header Field Descriptions .....................16
3.2. Chunk Field Descriptions ..................................17
3.2.1. Optional/Variable-Length Parameter Format ..........19
3.2.2. Reporting of Unrecognized Parameters ...............21
3.3. SCTP Chunk Definitions ....................................21
3.3.1. Payload Data (DATA) (0) ............................22
3.3.2. Initiation (INIT) (1) ..............................24
3.3.2.1. Optional/Variable-Length
Parameters in INIT ........................27
3.3.3. Initiation Acknowledgement (INIT ACK) (2) ..........30
3.3.3.1. Optional or Variable-Length Parameters ....33
3.3.4. Selective Acknowledgement (SACK) (3) ...............34
3.3.5. Heartbeat Request (HEARTBEAT) (4) ..................38
3.3.6. Heartbeat Acknowledgement (HEARTBEAT ACK) (5) ......39
3.3.7. Abort Association (ABORT) (6) ......................40
3.3.8. Shutdown Association (SHUTDOWN) (7) ................41
3.3.9. Shutdown Acknowledgement (SHUTDOWN ACK) (8) ........41
3.3.10. Operation Error (ERROR) (9) .......................42
3.3.10.1. Invalid Stream Identifier (1) ............44
3.3.10.2. Missing Mandatory Parameter (2) ..........44
3.3.10.3. Stale Cookie Error (3) ...................45
3.3.10.4. Out of Resource (4) ......................45
3.3.10.5. Unresolvable Address (5) .................46
3.3.10.6. Unrecognized Chunk Type (6) ..............46
3.3.10.7. Invalid Mandatory Parameter (7) ..........47
3.3.10.8. Unrecognized Parameters (8) ..............47
3.3.10.9. No User Data (9) .........................48
3.3.10.10. Cookie Received While Shutting
Down (10) ...............................48
3.3.10.11. Restart of an Association with
New Addresses (11) ......................49
3.3.10.12. User-Initiated Abort (12) ...............49
3.3.10.13. Protocol Violation (13) .................50
3.3.11. Cookie Echo (COOKIE ECHO) (10) ....................50
3.3.12. Cookie Acknowledgement (COOKIE ACK) (11) ..........51
3.3.13. Shutdown Complete (SHUTDOWN COMPLETE) (14) ........51
4. SCTP Association State Diagram .................................52
5. Association Initialization .....................................56
5.1. Normal Establishment of an Association ....................56
5.1.1. Handle Stream Parameters ...........................58
5.1.2. Handle Address Parameters ..........................58
5.1.3. Generating State Cookie ............................61
5.1.4. State Cookie Processing ............................62
5.1.5. State Cookie Authentication ........................62
5.1.6. An Example of Normal Association Establishment .....64
5.2. Handle Duplicate or Unexpected INIT, INIT ACK,
COOKIE ECHO, and ..........................................65
5.2.1. INIT Received in COOKIE-WAIT or
COOKIE-ECHOED State (Item B) .......................66
5.2.2. Unexpected INIT in States Other than
CLOSED, COOKIE-ECHOED, .............................66
5.2.3. Unexpected INIT ACK ................................67
5.2.4. Handle a COOKIE ECHO when a TCB Exists .............67
5.2.4.1. An Example of a Association Restart .......69
5.2.5. Handle Duplicate COOKIE-ACK. .......................71
5.2.6. Handle Stale COOKIE Error ..........................71
5.3. Other Initialization Issues ...............................72
5.3.1. Selection of Tag Value .............................72
5.4. Path Verification .........................................72
6. User Data Transfer .............................................73
6.1. Transmission of DATA Chunks ...............................75
6.2. Acknowledgement on Reception of DATA Chunks ...............78
6.2.1. Processing a Received SACK .........................81
6.3. Management of Retransmission Timer ........................83
6.3.1. RTO Calculation ....................................83
6.3.2. Retransmission Timer Rules .........................85
6.3.3. Handle T3-rtx Expiration ...........................86
6.4. Multi-Homed SCTP Endpoints ................................87
6.4.1. Failover from an Inactive Destination Address ......88
6.5. Stream Identifier and Stream Sequence Number ..............88
6.6. Ordered and Unordered Delivery ............................88
6.7. Report Gaps in Received DATA TSNs .........................89
6.8. CRC32c Checksum Calculation ...............................90
6.9. Fragmentation and Reassembly ..............................91
6.10. Bundling .................................................92
7. Congestion Control .............................................93
7.1. SCTP Differences from TCP Congestion Control ..............94
7.2. SCTP Slow-Start and Congestion Avoidance ..................95
7.2.1. Slow-Start .........................................96
7.2.2. Congestion Avoidance ...............................97
7.2.3. Congestion Control .................................98
7.2.4. Fast Retransmit on Gap Reports .....................98
7.3. Path MTU Discovery .......................................100
8. Fault Management ..............................................100
8.1. Endpoint Failure Detection ...............................100
8.2. Path Failure Detection ...................................101
8.3. Path Heartbeat ...........................................102
8.4. Handle "Out of the Blue" Packets .........................104
8.5. Verification Tag .........................................105
8.5.1. Exceptions in Verification Tag Rules ..............105
9. Termination of Association ....................................106
9.1. Abort of an Association ..................................107
9.2. Shutdown of an Association ...............................107
10. Interface with Upper Layer ...................................110
10.1. ULP-to-SCTP .............................................110
10.2. SCTP-to-ULP .............................................120
11. Security Considerations ......................................123
11.1. Security Objectives .....................................123
11.2. SCTP Responses to Potential Threats .....................124
11.2.1. Countering Insider Attacks .......................124
11.2.2. Protecting against Data Corruption in the
Network ..........................................124
11.2.3. Protecting Confidentiality .......................124
11.2.4. Protecting against Blind
Denial-of-Service Attacks ........................125
11.2.4.1. Flooding ................................125
11.2.4.2. Blind Masquerade ........................126
11.2.4.3. Improper Monopolization of Services .....127
11.3. SCTP Interactions with Firewalls ........................127
11.4. Protection of Non-SCTP-Capable Hosts ....................128
12. Network Management Considerations ............................128
13. Recommended Transmission Control Block (TCB) Parameters ......129
13.1. Parameters Necessary for the SCTP Instance ..............129
13.2. Parameters Necessary per Association (i.e., the TCB) ....129
13.3. Per Transport Address Data ..............................131
13.4. General Parameters Needed ...............................132
14. IANA Considerations ..........................................132
14.1. IETF-defined Chunk Extension ............................132
14.2. IETF-Defined Chunk Parameter Extension ..................133
14.3. IETF-Defined Additional Error Causes ....................133
14.4. Payload Protocol Identifiers ............................134
14.5. Port Numbers Registry ...................................134
15. Suggested SCTP Protocol Parameter Values .....................136
16. Acknowledgements .............................................137
Appendix A. Explicit Congestion Notification .....................139
Appendix B. CRC32c Checksum Calculation ..........................140
Appendix C. ICMP Handling ........................................142
References .......................................................149
Normative References ..........................................149
Informative References ........................................1501. Introduction ✨
okay so this section is the origin story bestie 💖 it's all about why the Stream Control Transmission Protocol (SCTP) got developed, what services it gives you, and the core concepts you need to know before the detailed protocol stuff hits. main character energy, literally 🎀
this document obsoletes [RFC2960] and [RFC3309]. 🫶
1.1. Motivation 🎀
Okay so, TCP [RFC0793] has been the main queen of reliable data transfer on IP networks, and honestly it has been doing immense service 💅. BUT, more and more newer apps have decided TCP is lowkey too limiting, so they built their own reliable transfer on top of UDP [RFC0768] 🦋. Here's what people were trying to get around:
- TCP gives you reliable data transfer AND strict in-order delivery 😭. Some apps only need reliability and don't care about sequence, and others would be happy with partial ordering. In both cases, TCP's head-of-line blocking adds delay nobody asked for 💀.
- TCP is a stream, and that's a whole vibe 🙈. Apps have to add their own record marking to show where each message starts and ends, and they have to use the push facility on purpose so a full message actually gets sent in a reasonable time.
- TCP sockets have a limited scope, which makes it harder to get highly-available data transfer using multi-homed hosts 🌸.
- TCP is pretty vulnerable to denial-of-service attacks, like SYN attacks 😬.
All of these TCP limitations matter for transporting PSTN signaling over IP, and that application is what directly motivated SCTP ✨. Other apps might find SCTP is a perfect match for what they need too 👑.
1.2. Architectural View of SCTP 🧚
SCTP sits as a layer between the SCTP user application (the "SCTP user" for short) and a connectionless packet network service like IP 💖. The rest of this document assumes SCTP runs on top of IP. Its basic service is reliable transfer of user messages between peer SCTP users, and it does this inside an association between two SCTP endpoints 🫶. Section 10 of this document sketches the API that should exist at the boundary between the SCTP and SCTP user layers.
SCTP is connection-oriented, but an SCTP association is a much broader concept than a TCP connection 🌈. During association startup, each SCTP endpoint (see Section 1.3) gives the other endpoint a list of transport addresses (so multiple IP addresses paired with an SCTP port) that it can be reached at and will send SCTP packets from ✨. The association covers transfers across all the possible source/destination combinations that can come from each endpoint's list 🔥.
_____________ _____________
| SCTP User | | SCTP User |
| Application | | Application |
|-------------| |-------------|
| SCTP | | SCTP |
| Transport | | Transport |
| Service | | Service |
|-------------| |-------------|
| |One or more ---- One or more| |
| IP Network |IP address \/ IP address| IP Network |
| Service |appearances /\ appearances| Service |
|_____________| ---- |_____________|
SCTP Node A |<-------- Network transport ------->| SCTP Node B
Figure 1: An SCTP Association1.3. Key Terms ✨
Okay bestie, we've already dipped our toes into some SCTP vocab, so this section is basically the glossary 📖💅. Here's every key term in one place with its meaning.
- Active destination transport address: a transport address on a peer endpoint that the sending endpoint thinks is available for receiving user messages 🦋
- Bundling: an optional multiplexing move where more than one user message can ride in the same SCTP packet. Each user message still gets its own DATA chunk 🎀
- Chunk: a unit of info inside an SCTP packet, made of a chunk header plus chunk-specific content 🧚
- Congestion window (cwnd): an SCTP variable that caps how many bytes a sender can push to one destination transport address before an acknowledgement comes back 🌊
- Cumulative TSN Ack Point: the TSN of the last DATA chunk that got acknowledged through the Cumulative TSN Ack field of a SACK 💜
- Idle destination address: an address that hasn't been sent any user messages for a while, normally the HEARTBEAT interval or longer 💤
- Inactive destination transport address: an address that's marked inactive because of errors, so it isn't used for transporting user messages 🥀
- Message = user message: data handed to SCTP by the Upper Layer Protocol (ULP) 📨
- Message Authentication Code (MAC): an integrity check built on cryptographic hash functions and a secret key. MACs are usually used between two parties that share that secret so they can validate info passing between them. In SCTP, an endpoint uses it to validate the State Cookie info sent back by the peer in the COOKIE ECHO chunk 🔐. The term "MAC" means different things in different contexts, but SCTP uses it with the same meaning as in [RFC2104] 📚
- Network Byte Order: most significant byte first, a.k.a., big endian 🍓
- Ordered Message: a user message that gets delivered in order compared to all earlier user messages sent on the same stream 🎀
- Outstanding TSN (at an SCTP endpoint): a TSN (plus its DATA chunk) that the endpoint has sent but hasn't received an acknowledgement for yet ⏳
- Path: the route taken by SCTP packets sent from one endpoint to a specific destination transport address of its peer. Sending to different destination transport addresses doesn't automatically mean you get different paths 🛣️
- Primary Path: the destination and source address that get put into a packet heading to the peer by default. The source address is included because an implementation MAY want to set both the destination and source address so it can control the return path that reply chunks take, plus which interface the packet goes out on when the data sender is multi-homed 🏠
- Receiver Window (rwnd): an SCTP variable the data sender uses to store the most recently calculated receiver window of its peer, in bytes. It tells the sender how much room is left in the receiver's inbound buffer 🪟
- SCTP association: a protocol relationship between SCTP endpoints. It's made up of the two endpoints plus protocol state info, including Verification Tags and the current set of Transmission Sequence Numbers (TSNs), and so on. An association can be uniquely identified by the transport addresses its endpoints use. Two SCTP endpoints MUST NOT have more than one SCTP association between them at any given time 🚫
- SCTP endpoint: the logical sender and receiver of SCTP packets. On a multi-homed host, an endpoint is shown to its peers as a combo of a set of eligible destination transport addresses (where SCTP packets can be sent) and a set of eligible source transport addresses (where SCTP packets can be received from). All transport addresses an endpoint uses must share the same port number, but they can use multiple IP addresses. A transport address used by one endpoint must not be used by another, so each transport address belongs to exactly one SCTP endpoint 🧍♀️
- SCTP packet (or packet): the unit of data delivery across the interface between SCTP and the connectionless packet network (e.g., IP). An SCTP packet includes the common SCTP header, possibly some SCTP control chunks, and user data wrapped up inside SCTP DATA chunks 📦
- SCTP user application (SCTP user): the logical higher-layer application entity that uses SCTP's services. It's also called the Upper-Layer Protocol (ULP) 👑
- Slow-Start Threshold (ssthresh): an SCTP variable. It's the threshold the endpoint uses to decide whether to do slow start or congestion avoidance on a particular destination transport address. Ssthresh is measured in bytes 📈
- Stream: a unidirectional logical channel from one associated SCTP endpoint to another. Within it, all user messages are delivered in sequence, except for those sent using the unordered delivery service 🌈
Note: The relationship between stream numbers in opposite directions is strictly a matter of how the applications use them. It is the responsibility of the SCTP user to create and manage these correlations if they are so desired. 🙈
- Stream Sequence Number: a 16-bit sequence number SCTP uses internally to make sure user messages get delivered in sequence within a given stream. One Stream Sequence Number is attached to each user message 🔢
- Tie-Tags: two 32-bit random numbers that together form a 64-bit nonce. These tags live in a State Cookie and a TCB so a newly restarting association can be linked back to the original association inside the endpoint that did not restart, without revealing the real Verification Tags of an existing association 🤫
- Transmission Control Block (TCB): an internal data structure an SCTP endpoint creates for each of its existing associations with other SCTP endpoints. The TCB holds all the status and operational info the endpoint needs to maintain and manage that association 🗂️
- Transmission Sequence Number (TSN): a 32-bit sequence number SCTP uses internally. One TSN is attached to each chunk containing user data, so the receiving endpoint can acknowledge receipt and spot duplicate deliveries 🔁
- Transport address: traditionally defined by a network-layer address, a transport-layer protocol, and a transport-layer port number. For SCTP running over IP, a transport address is the combo of an IP address and an SCTP port number (where SCTP is the transport protocol) 🌐
- Unacknowledged TSN (at an SCTP endpoint): a TSN (plus its DATA chunk) that the endpoint has received but hasn't sent an acknowledgement for yet. In the opposite case, it's a packet that has been sent but has not had an acknowledgement received yet 🫥
- Unordered Message: unordered messages are "unordered" compared to any other message, including both other unordered messages and ordered messages. An unordered message might be delivered before or after ordered messages sent on the same stream 🌀
- User message: the unit of data delivery across the interface between SCTP and its user 💌
- Verification Tag: a randomly generated 32-bit unsigned integer. It's a key that lets a receiver check that an SCTP packet belongs to the current association and isn't an old or stale packet from a previous association 🔑
1.4. Abbreviations 🌸
Here are the abbreviations you'll keep seeing:
MAC - Message Authentication Code [RFC2104]
RTO - Retransmission Timeout
RTT - Round-Trip Time
RTTVAR - Round-Trip Time Variation
SCTP - Stream Control Transmission Protocol
SRTT - Smoothed RTT
TCB - Transmission Control Block
TLV - Type-Length-Value coding format
TSN - Transmission Sequence Number
ULP - Upper-Layer Protocol1.5. Functional View of SCTP 🦋
Okay so the SCTP transport service can be broken down into a bunch of functions 🧩. Figure 2 shows them, and we'll walk through each one in the rest of this section 👀.
SCTP User Application
-----------------------------------------------------
_____________ ____________________
| | | Sequenced Delivery |
| Association | | within Streams |
| | |____________________|
| Startup |
| | ____________________________
| and | | User Data Fragmentation |
| | |____________________________|
| Takedown |
| | ____________________________
| | | Acknowledgement |
| | | and |
| | | Congestion Avoidance |
| | |____________________________|
| |
| | ____________________________
| | | Chunk Bundling |
| | |____________________________|
| |
| | ________________________________
| | | Packet Validation |
| | |________________________________|
| |
| | ________________________________
| | | Path Management |
|_____________| |________________________________|
Figure 2: Functional View of the SCTP Transport Service1.5.1. Association Startup and Takedown ✨
okay so an association gets started when the SCTP user asks for it 💖 (peep the ASSOCIATE (or SEND) primitive in Section 10 if you want the deets).
A cookie mechanism, kinda like the one Karn and Simpson came up with in [RFC2522], shows up during initialization to protect against synchronization attacks 🛡️. It runs a four-way handshake, and the last two legs are allowed to carry user data for fast setup 🚀. The startup sequence is spelled out in Section 5 of this document.
SCTP gives you a graceful close (shutdown) of an active association whenever the SCTP user asks for one. Check out the SHUTDOWN primitive in Section 10 🌸. It also does an ungraceful close (abort) 💀, either because the user hit the ABORT primitive or because the SCTP layer spotted an error condition. Section 9 covers both the graceful and the ungraceful close procedures.
SCTP does not support a half-open state (unlike TCP) where one side keeps sending data while the other end is closed 🙅♀️. When either endpoint does a shutdown, the association on each peer stops accepting new data from its user and only delivers whatever was already in the queue at the time of the graceful close (see Section 9). no cap, that's a clean breakup 💅
1.5.2. Sequenced Delivery within Streams 🎀
So "stream" in SCTP means a sequence of user messages that have to be delivered to the upper-layer protocol in order with respect to other messages in that same stream. This is different from TCP, where a stream is a sequence of bytes (in this document, a byte is assumed to be 8 bits) 🤓.
The SCTP user can pick the number of streams the association supports when it starts up 🧚. That number gets negotiated with the remote end (see Section 5.1.1). User messages are tied to stream numbers (SEND and RECEIVE primitives, Section 10). Internally, SCTP gives every message the SCTP user hands over a Stream Sequence Number. On the receiving side, SCTP makes sure messages reach the SCTP user in sequence within a given stream. BUT here's the iconic part: while one stream is stuck waiting for the next in-sequence message, the other streams can keep delivering 🦋.
SCTP also has a way to bypass the sequenced delivery service, and messages sent that way get delivered to the SCTP user the second they arrive ⚡.
1.5.3. User Data Fragmentation 🧩
When it's needed, SCTP fragments user messages so the SCTP packet handed to the lower layer fits the path MTU. On receipt, the fragments get put back together into complete messages before they're passed up to the SCTP user 🫶.
1.5.4. Acknowledgement and Congestion Avoidance 🌈
SCTP gives each user data fragment (or unfragmented message) a Transmission Sequence Number (TSN) 🔢. The TSN is totally independent of any Stream Sequence Number assigned at the stream level. The receiving end acknowledges every TSN it gets, even if there are gaps in the sequence. This is how reliable delivery stays functionally separate from sequenced stream delivery, which is honestly so smart 👑.
The acknowledgement and congestion avoidance function is the one in charge of retransmitting packets when a timely acknowledgement hasn't arrived 🔁. Retransmission is governed by congestion avoidance procedures that are similar to the ones TCP uses. For the full details on the protocol procedures for this function, see Section 6 and Section 7 📚.
1.5.5. Chunk Bundling 🍓
As Section 3 describes, the SCTP packet delivered to the lower layer is a common header followed by one or more chunks. Each chunk can carry either user data or SCTP control information. The SCTP user can ask for more than one user message to be bundled into a single SCTP packet. The chunk bundling function is responsible for assembling the complete SCTP packet and taking it apart again at the receiving end 📦.
During times of congestion, an SCTP implementation MAY still bundle even if the user asked it not to bundle 🙈. The user's disabling of bundling only affects implementations that might hold a packet for a small bit of time before transmitting it (to try to encourage bundling). When the user layer disables bundling, that small delay is prohibited, but bundling that happens during congestion or retransmission still goes ahead 💅.
1.5.6. Packet Validation 🔐
Every SCTP common header includes a mandatory Verification Tag field and a 32-bit checksum field (check Appendix B for the CRC32c checksum). Each end of the association picks its Verification Tag value during association startup. Packets that show up without the expected Verification Tag value get discarded 🚫. This protects against blind masquerade attacks and against stale SCTP packets from a previous association, which is giving main character defense energy 😤. The CRC32c checksum should be set by the sender of each SCTP packet, adding extra protection against data corruption in the network. If the receiver gets an SCTP packet with an invalid CRC32c checksum, it silently discards the packet 🤫.
1.5.7. Path Management 🗺️
The sending SCTP user can manipulate the set of transport addresses used as destinations for SCTP packets through the primitives described in Section 10. The SCTP path management function picks the destination transport address for each outgoing SCTP packet, based on the SCTP user's instructions and the currently perceived reachability status of the eligible destination set. When other packet traffic isn't enough to tell reachability, the path management function monitors it through heartbeats, and it lets the SCTP user know whenever the reachability of any far-end transport address changes 📡. It's also responsible for reporting the eligible set of local transport addresses to the far end during association startup, and for passing along the transport addresses returned from the far end to the SCTP user 💜.
At association startup, a primary path gets defined for each SCTP endpoint, and that's the path used for normal sending of SCTP packets 🛣️.
On the receiving end, path management has to verify that a valid SCTP association exists for the inbound SCTP packet before the packet gets passed along for further processing 🕵️♀️.
Note: Path Management and Packet Validation happen at the same time. So even though I described them separately above, in reality they can't be performed as separate items 🥺.
1.6. Serial Number Arithmetic ⏳
It is essential to remember that the actual Transmission Sequence Number space is finite, though very large 🌌. This space ranges from 0 to 2**32 - 1. Because the space is finite, all arithmetic dealing with Transmission Sequence Numbers must be performed modulo 2**32. This unsigned arithmetic keeps the relationship of sequence numbers intact as they cycle from 2**32 - 1 back to 0. Computer modulo arithmetic has some subtleties, so great care should be taken when programming the comparison of these values 🧠. When referring to TSNs, the symbol =< means "less than or equal" (modulo 2**32).
Comparisons and arithmetic on TSNs in this document SHOULD use Serial Number Arithmetic as defined in [RFC1982] where SERIAL_BITS = 32.
An endpoint SHOULD NOT transmit a DATA chunk with a TSN that is more than 2**31 - 1 above the beginning TSN of its current send window. Doing so will cause problems when comparing TSNs 😬.
Transmission Sequence Numbers wrap around when they reach 2**32 - 1. That means the next TSN a DATA chunk MUST use after transmitting TSN = 2*32 - 1 is TSN = 0 🔄.
Any arithmetic done on Stream Sequence Numbers SHOULD use Serial Number Arithmetic as defined in [RFC1982] where SERIAL_BITS = 16. All other arithmetic and comparisons in this document use normal arithmetic ✨.
1.7. Changes from RFC 2960 📝
SCTP was originally defined in [RFC2960], which this document obsoletes. If you're curious about the details of the various changes this document brings in, go read [RFC4460] 📖.
2. Conventions 🎀
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119] 💅.
3. SCTP Packet Format 📦
An SCTP packet is composed of a common header and chunks. A chunk contains either control information or user data 🦋.
The SCTP packet format looks like this:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Common Header |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Chunk #1 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Chunk #n |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Multiple chunks can be bundled into one SCTP packet up to the MTU size, except for the INIT, INIT ACK, and SHUTDOWN COMPLETE chunks. These chunks MUST NOT be bundled with any other chunk in a packet 🚫. See Section 6.10 for more details on chunk bundling.
If a user data message doesn't fit into one SCTP packet, it can be fragmented into multiple chunks using the procedure defined in Section 6.9 🧩.
All integer fields in an SCTP packet MUST be transmitted in network byte order, unless otherwise stated 🌸.
3.1. SCTP Common Header Field Descriptions 💅
okay so every SCTP packet starts with this common header, and it's lowkey the bouncer of the whole packet 🚪✨ here's the layout:
SCTP Common Header Format
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Source Port Number | Destination Port Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Verification Tag |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Checksum |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Source Port Number: 16 bits (unsigned integer) 💌
okay so this is the sender's port number. The receiver can team it up with the source IP address, the SCTP destination port, and possibly the destination IP address to figure out which association this packet belongs to 🔍 Port number 0 MUST NOT be used 🙅♀️
Destination Port Number: 16 bits (unsigned integer) 🎯
this is the SCTP port number the packet is headed for. The receiving host uses it to de-multiplex the packet to the right receiving endpoint or application, so it's giving postal code energy 📬 Port number 0 MUST NOT be used 🙅♀️
Verification Tag: 32 bits (unsigned integer) 🪪
the receiver checks this to validate who actually sent the packet, so it's the ID badge of the whole thing 🪪💜 On transmit, the Verification Tag MUST be set to the Initiate Tag the peer gave you during association initialization, but there are a few exceptions, obviously 😭
- A packet containing an INIT chunk MUST have a zero Verification Tag.
- A packet containing a SHUTDOWN COMPLETE chunk with the T bit set MUST have the Verification Tag copied from the packet with the SHUTDOWN ACK chunk.
- A packet containing an ABORT chunk may have the verification tag copied from the packet that caused the ABORT to be sent. For details see Section 8.4 and Section 8.5.
An INIT chunk MUST be the only chunk in the SCTP packet carrying it. Solo queen moment 👑 no sharing the spotlight 🎤
Checksum: 32 bits (unsigned integer) 🧮
this field holds the checksum of the packet, and how it gets calculated is covered in Section 6.8 🤓 SCTP uses the CRC32c algorithm, described in Appendix B, to work it out. It's literally the packet's receipt 🧾✨
3.2. Chunk Field Descriptions 🎀
okay so this is the format for the chunks that ride inside an SCTP packet 🚗 Each chunk comes with a Chunk Type field, a chunk-specific Flag field, a Chunk Length field, and a Value field. Think of it like a little labeled box 📦
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Chunk Type | Chunk Flags | Chunk Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
\ \
/ Chunk Value /
\ \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Chunk Type: 8 bits (unsigned integer) 🏷️
this field tells you what kind of info lives in the Chunk Value field. It takes a value from 0 to 254. The value of 255 is reserved for future use as an extension field 🔮
The values of Chunk Types are defined as follows 👀
ID Value Chunk Type
----- ----------
0 - Payload Data (DATA)
1 - Initiation (INIT)
2 - Initiation Acknowledgement (INIT ACK)
3 - Selective Acknowledgement (SACK)
4 - Heartbeat Request (HEARTBEAT)
5 - Heartbeat Acknowledgement (HEARTBEAT ACK)
6 - Abort (ABORT)
7 - Shutdown (SHUTDOWN)
8 - Shutdown Acknowledgement (SHUTDOWN ACK)
9 - Operation Error (ERROR)
10 - State Cookie (COOKIE ECHO)
11 - Cookie Acknowledgement (COOKIE ACK)
12 - Reserved for Explicit Congestion Notification Echo
(ECNE)
13 - Reserved for Congestion Window Reduced (CWR)
14 - Shutdown Complete (SHUTDOWN COMPLETE)
15 to 62 - available
63 - reserved for IETF-defined Chunk Extensions
64 to 126 - available
127 - reserved for IETF-defined Chunk Extensions
128 to 190 - available
191 - reserved for IETF-defined Chunk Extensions
192 to 254 - available
255 - reserved for IETF-defined Chunk ExtensionsChunk Types are encoded so the highest-order 2 bits decide what happens if the processing endpoint doesn't recognize the Chunk Type. It's like a built-in plan for the unknown 🧠💅
00- Stop processing this SCTP packet and discard it, do not process any further chunks within it.01- Stop processing this SCTP packet and discard it, do not process any further chunks within it, and report the unrecognized chunk in an 'Unrecognized Chunk Type'.10- Skip this chunk and continue processing.11- Skip this chunk and continue processing, but report in an ERROR chunk using the 'Unrecognized Chunk Type' cause of error.
Note: The ECNE and CWR chunk types are reserved for future use of Explicit Congestion Notification (ECN); see Appendix A. Saving these for later, bestie 🌈
Chunk Flags: 8 bits 🚩
what these bits mean depends on the Chunk Type. Unless otherwise specified, they're set to 0 on transmit and ignored on receipt. Chill vibes only 😌
Chunk Length: 16 bits (unsigned integer) 📏
this is the size of the chunk in bytes, counting the Chunk Type, Chunk Flags, Chunk Length, and Chunk Value fields. So if the Chunk Value is zero-length, the Length field is set to 4. The Chunk Length field does not count any chunk padding 🙈
Chunks (including Type, Length, and Value fields) get padded out by the sender with all zero bytes so they're a multiple of 4 bytes long. This padding MUST NOT be more than 3 bytes in total. The Chunk Length value doesn't include the terminating padding of the chunk, but it does include padding of any variable-length parameter except the last parameter in the chunk. The receiver MUST ignore the padding. 🫶
Note: A robust implementation should accept the chunk whether or not the final padding has been included in the Chunk Length. Be the friend who's flexible 🌸
Chunk Value: variable length 🎁
this is where the actual info goes. Its usage and format depend on the Chunk Type 💖
The total length of a chunk (including Type, Length, and Value fields) MUST be a multiple of 4 bytes. If the chunk isn't a multiple of 4 bytes, the sender MUST pad it with all zero bytes, and that padding isn't included in the Chunk Length field. The sender MUST NOT pad with more than 3 bytes. The receiver MUST ignore the padding bytes. Padding rules, but make it cute 🎀
SCTP-defined chunks are described in detail in Section 3.3. The guidelines for IETF-defined chunk extensions can be found in Section 14.1 of this document 📚
3.2.1. Optional/Variable-Length Parameter Format 🧩
okay so the Chunk Value of an SCTP control chunk has a chunk-type-specific header of required fields, followed by zero or more parameters. The optional and variable-length parameters inside a chunk all use a Type-Length-Value format, shown below 🍓
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Parameter Type | Parameter Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
\ \
/ Parameter Value /
\ \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Chunk Parameter Type: 16 bits (unsigned integer) 🔖
this is a 16-bit identifier for the type of parameter. It takes a value of 0 to 65534. The value of 65535 is reserved for IETF-defined extensions. Values other than those defined in specific SCTP chunk descriptions are reserved for use by IETF 🌟
Chunk Parameter Length: 16 bits (unsigned integer) 📐
this is the size of the parameter in bytes, counting the Parameter Type, Parameter Length, and Parameter Value fields. So a parameter with a zero-length Parameter Value would have a Length field of 4. The Parameter Length doesn't include any padding bytes 🫧
Chunk Parameter Value: variable length 💌
this is the actual info carried in the parameter ✨
The total length of a parameter (including Type, Parameter Length, and Value fields) MUST be a multiple of 4 bytes. If the parameter isn't a multiple of 4 bytes, the sender pads it at the end (after the Parameter Value field) with all zero bytes. The padding length isn't counted in the Parameter Length field. A sender MUST NOT pad with more than 3 bytes. The receiver MUST ignore the padding bytes. 🙌
The Parameter Types are encoded so the highest-order 2 bits decide what happens if the processing endpoint doesn't recognize the Parameter Type. Same vibe as the chunk types, just one level down 🧁
00- Stop processing this parameter; do not process any further parameters within this chunk.01- Stop processing this parameter, do not process any further parameters within this chunk, and report the unrecognized parameter in an 'Unrecognized Parameter', as described in Section 3.2.2.10- Skip this parameter and continue processing.11- Skip this parameter and continue processing but report the unrecognized parameter in an 'Unrecognized Parameter', as described in Section 3.2.2.
Please note that in all four cases, an INIT ACK or COOKIE ECHO chunk is sent. 📨 In the 00 or 01 case, processing of the parameters after the unknown parameter is canceled, but no processing already done is rolled back. Nothing already done gets undone, sis 😅
The actual SCTP parameters are defined in the specific SCTP chunk sections. The rules for IETF-defined parameter extensions are defined in Section 14.2. Note that a parameter type MUST be unique across all chunks. For example, the parameter type '5' is used to represent an IPv4 address (see Section 3.3.2.1). The value '5' then is reserved across all chunks to represent an IPv4 address and MUST NOT be reused with a different meaning in any other chunk. Parameter type 5 is the IPv4 address, everywhere, forever 🌍💜
3.2.2. Reporting of Unrecognized Parameters ✨
okay so if the receiver of an INIT chunk spots unrecognized parameters and has to report them (see Section 3.2.1), it MUST put the 'Unrecognized Parameter' parameter(s) in the INIT ACK chunk it sends back 💅. but heads up bestie: if the INIT receiver is NOT going to establish an association (say, it's out of resources), then an 'Unrecognized Parameter' would NOT be included in any ABORT sent to the INIT sender 🙈
now for the INIT ACK side 🫶 if the receiver of an INIT ACK chunk finds unrecognized parameters and has to report them (again, Section 3.2.1), it SHOULD bundle the ERROR chunk with the 'Unrecognized Parameters' error cause together with the COOKIE ECHO chunk it sends in response to the INIT ACK. if the INIT ACK receiver can't bundle the COOKIE ECHO with the ERROR chunk, the ERROR chunk MAY be sent separately, but not before the COOKIE ACK has been received 🦋
and one more thing that's lowkey the most important: any time a COOKIE ECHO is sent in a packet, it MUST be the first chunk. no exceptions, periodt 👑
3.3. SCTP Chunk Definitions 🌈
this section is where we define the format of each SCTP chunk type 🧚
3.3.1. Payload Data (DATA) (0) 💖
the following format MUST be used for the DATA chunk 🎀
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 0 | Reserved|U|B|E| Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| TSN |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Stream Identifier S | Stream Sequence Number n |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Payload Protocol Identifier |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
\ \
/ User Data (seq n of Stream S) /
\ \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Reserved: 5 bits 🍓 these should be all '0's, and the receiver just ignores them.
U bit: 1 bit 🦋 the (U)nordered bit! if it's set to '1', this is an unordered DATA chunk, and there's no Stream Sequence Number assigned to it. so the receiver MUST ignore the Stream Sequence Number field, no peeking allowed 🙈
after reassembly (if it's needed), unordered DATA chunks MUST be dispatched to the upper layer by the receiver without any attempt to reorder. literally no reordering, it's giving chaos but make it intentional ✨
if an unordered user message gets fragmented, every single fragment of that message MUST have its U bit set to '1' 💅
B bit: 1 bit 🌸 the (B)eginning fragment bit, when it's set, tells you this is the first fragment of a user message.
E bit: 1 bit 🌸 the (E)nding fragment bit, when it's set, tells you this is the last fragment of a user message.
an unfragmented user message shall have both the B and E bits set to '1' 🫶 and setting both B and E to '0' means you've got a middle fragment of a multi-fragment user message. here's the cheat sheet 💜
B E Description
============================================================
| 1 0 | First piece of a fragmented user message |
+----------------------------------------------------------+
| 0 0 | Middle piece of a fragmented user message |
+----------------------------------------------------------+
| 0 1 | Last piece of a fragmented user message |
+----------------------------------------------------------+
| 1 1 | Unfragmented message |
============================================================
| Table 1: Fragment Description Flags |
============================================================when a user message gets split into multiple chunks, the receiver uses the TSNs to put it back together 🧩 so the TSNs for each fragment of a fragmented user message MUST be strictly sequential. no skipping, no shuffling, bestie 😭
Length: 16 bits (unsigned integer) 📏 this is the length of the DATA chunk in bytes, counting from the beginning of the type field to the end of the User Data field, not including padding. so a DATA chunk with one byte of user data will have Length set to 17 (that's 17 bytes, iykyk ✨)
a DATA chunk with a User Data field of length L will have the Length field set to (16 + L), which is 16+L bytes, where L MUST be greater than 0. an empty payload is not it 💀
TSN: 32 bits (unsigned integer) 🔢 this is the TSN for this DATA chunk. the valid range is from 0 to 4294967295 (2**32 - 1). and yes, TSN wraps back to 0 after hitting 4294967295. the loop is real 🌈
Stream Identifier S: 16 bits (unsigned integer) 🎀 this identifies the stream the following user data belongs to.
Stream Sequence Number n: 16 bits (unsigned integer) 🧚 this is the Stream Sequence Number of the following user data within stream S. valid range is 0 to 65535.
when SCTP fragments a user message for transport, the same Stream Sequence Number MUST be carried in each of the fragments of that message. consistency is the whole vibe 💖
Payload Protocol Identifier: 32 bits (unsigned integer) 💜 this is an application (or upper layer) specified protocol identifier. the upper layer hands it to SCTP, and SCTP sends it along to the peer. SCTP itself doesn't use this identifier, but certain network entities, plus the peer application, can use it to figure out what kind of info is in this DATA chunk 👀 it must be sent even in fragmented DATA chunks, so it's still available for agents in the middle of the network. also, SCTP never touches this field, so its byte order is NOT necessarily big endian. the upper layer handles any byte order conversions 🫶
the value 0 means no application identifier was specified by the upper layer for this payload data 🌸
User Data: variable length 🍓 this is the payload user data. the implementation MUST pad the end of the data to a 4-byte boundary with all-zero bytes. any padding MUST NOT be included in the Length field. and a sender MUST never add more than 3 bytes of padding. boundaries respected, no extra fluff 💅✨
3.3.2. Initiation (INIT) (1) 🦋
okay bestie, the INIT chunk is basically the "hiii, wanna be friends? 💌" message of SCTP. It's how two endpoints kick off an association, and it's giving main character energy 👑 ✨. Here's how the chunk is laid out:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 1 | Chunk Flags | Chunk Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Initiate Tag |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Advertised Receiver Window Credit (a_rwnd) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Number of Outbound Streams | Number of Inbound Streams |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Initial TSN |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
\ \
/ Optional/Variable-Length Parameters /
\ \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+So the INIT chunk carries a bunch of parameters 🧚. Unless otherwise noted, each parameter MUST only be included once in the INIT chunk, no doubles allowed 🙅♀️. Here are the fixed ones, which are all Mandatory:
Fixed Parameters Status
----------------------------------------------
Initiate Tag Mandatory
Advertised Receiver Window Credit Mandatory
Number of Outbound Streams Mandatory
Number of Inbound Streams Mandatory
Initial TSN MandatoryAnd then the variable ones, which are where the drama is 🎀:
Variable Parameters Status Type Value
-------------------------------------------------------------
IPv4 Address (Note 1) Optional 5 IPv6 Address
(Note 1) Optional 6 Cookie Preservative
Optional 9 Reserved for ECN Capable (Note 2) Optional
32768 (0x8000) Host Name Address (Note 3) Optional
11 Supported Address Types (Note 4) Optional 12Note 1 is the one about addresses: an INIT chunk can carry multiple addresses, and they can be IPv4 and/or IPv6 in any combination 🌈. Note 2 is the ECN Capable field, which is reserved for future use of Explicit Congestion Notification 🔮.
Note 3 is where it gets spicy 🌶️. An INIT chunk MUST NOT contain more than one Host Name Address parameter. The sender of the INIT also MUST NOT combine any other address types with the Host Name Address in the INIT. And if the receiver of the INIT sees a Host Name Address parameter, it MUST ignore any other address types in that INIT chunk. Strict, but iconic 💅.
Note 4 says the Supported Address Types parameter, when it's there, tells you every address type the sending endpoint can support. If it's absent, that means the sending endpoint can support any address type 🦋.
IMPLEMENTATION NOTE: If an INIT chunk is received with known parameters that aren't optional parameters of the INIT chunk, the receiver SHOULD process the INIT chunk and send back an INIT ACK. The receiver of the INIT chunk MAY bundle an ERROR chunk with the COOKIE ACK chunk later. But restrictive implementations MAY send back an ABORT chunk in response to the INIT chunk instead 🙈.
About the Chunk Flags field: it's reserved in INIT, and all of its bits should be set to 0 by the sender and ignored by the receiver 🫶. Also, the parameters inside an INIT can be processed in any order, so no stress about sequencing 🌸.
Initiate Tag: 32 bits (unsigned integer)
Okay, this one is so important 😭. The receiver of the INIT (aka the responding end) records the value of the Initiate Tag parameter. That value MUST be placed into the Verification Tag field of every SCTP packet that the receiver of the INIT transmits within this association. So it's like a secret handshake that every packet has to carry 🔐.
The Initiate Tag is allowed to have any value except 0 ✨. Check Section 5.3.1 if you want the deets on how to pick that tag value.
And if a received INIT chunk has an Initiate Tag of 0, the receiver MUST treat it as an error and close the association by transmitting an ABORT. Big nope 💀.
Advertised Receiver Window Credit (a_rwnd): 32 bits (unsigned integer)
This value is the dedicated buffer space, in number of bytes, that the sender of the INIT has reserved for this association 🧺. During the life of the association, this buffer space SHOULD NOT be lessened (aka the dedicated buffers shouldn't get taken away from this association). BUT, an endpoint MAY change the value of a_rwnd it sends in SACK chunks, so there's still some wiggle room 🌈.
Number of Outbound Streams (OS): 16 bits (unsigned integer)
This defines how many outbound streams the sender of this INIT chunk wants to create in this association 🌊. The value of 0 MUST NOT be used, because zero streams is just a vibe with no vibes 🙃.
Note: A receiver of an INIT with the OS value set to 0 SHOULD abort the association. Yikes, so that's a red flag 🚩.
Number of Inbound Streams (MIS): 16 bits (unsigned integer)
This defines the maximum number of streams that the sender of this INIT chunk allows the peer end to create in this association 🎟️. Again, the value 0 MUST NOT be used.
Note: There's no negotiation of the actual number of streams. Instead, the two endpoints use the min(requested, offered). Literally just the smaller number wins 🏆. Check Section 5.1.1 for the details.
Note: A receiver of an INIT with the MIS value of 0 SHOULD abort the association, same energy as the OS one 💅.
Initial TSN (I-TSN): 32 bits (unsigned integer)
This defines the initial TSN that the sender will use 🍓. The valid range is from 0 to 4294967295. And honestly, this field MAY be set to the value of the Initiate Tag field, which is a cute little shortcut if you want it 🧚♀️.
3.3.2.1. Optional/Variable-Length Parameters in INIT ✨
okay so these parameters all follow the Type-Length-Value format from Section 3.2.1 🎀 and any TLV fields MUST come after the fixed-length fields from the previous section. no skipping ahead, bestie 💅
IPv4 Address Parameter (5) 🦋
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 5 | Length = 8 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| IPv4 Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+IPv4 Address: 32 bits (unsigned integer) 🌸
this one holds an IPv4 address of the sending endpoint, binary encoded. so cute, no notes 🫶
IPv6 Address Parameter (6) 🌈
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 6 | Length = 20 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
| IPv6 Address |
| |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+IPv6 Address: 128 bits (unsigned integer) 💜
this holds an IPv6 [RFC2460] address of the sending endpoint, also binary encoded 🦋
Note: a sender MUST NOT use an IPv4-mapped IPv6 address [RFC4291] 🙈 it should instead use an IPv4 Address parameter for an IPv4 address. not the vibe, bestie 💀
okay the big picture: combined with the Source Port Number in the SCTP common header, the value in an IPv4 or IPv6 Address parameter tells you a transport address the INIT sender will support for the association being set up. 🧚 so during the whole life of this association, that IP can show up as the source address on an IP datagram from the INIT sender, and it can be the destination address on an IP datagram from the INIT receiver. main character energy 👑
more than one IP Address parameter can be in an INIT chunk when the INIT sender is multi-homed. and a multi-homed endpoint might have access to different kinds of networks, so one INIT chunk can carry more than one address type. IPv4 and IPv6 addresses are both allowed in the same INIT chunk, iykyk 💅✨
if the INIT has at least one IP Address parameter, then the source address of the IP datagram carrying the INIT chunk, plus any extra addresses in the INIT, can be used as destinations by the endpoint receiving the INIT 🎀 if the INIT has no IP Address parameters at all, the receiving endpoint MUST use the source address from the received IP datagram as its only destination address for the association. literally the only option 😭
and not including any IP Address parameters in the INIT and INIT ACK is an alternative for making an association more likely to work across a NAT box 🍓
Cookie Preservative (9) 🫧
the sender of the INIT shall use this parameter to ask the receiver of the INIT for a longer life-span on the State Cookie ⭐
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 9 | Length = 8 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Suggested Cookie Life-Span Increment (msec.) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Suggested Cookie Life-Span Increment: 32 bits (unsigned integer) 🧁
this tells the receiver how many milliseconds of extra life the sender wants added to its default cookie life-span ⏳
this optional parameter should be added to the INIT chunk by the sender when it tries again to set up an association with a peer whose previous attempt failed because of a stale cookie operation error 🔁 the receiver MAY choose to ignore the suggested cookie life-span increase for its own security reasons. the receiver's call, bestie 🔐
Host Name Address (11) 🌷
the sender of INIT uses this parameter to pass its Host Name (instead of its IP addresses) to its peer 🗺️ the peer is responsible for resolving the name. using this parameter might make the association more likely to work across a NAT box, periodt ✨
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 11 | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
/ Host Name /
\ \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Host Name: variable length 🎀
this field has a host name in "host name syntax" per RFC 1123 Section 2.1 [RFC1123] 📖 how you resolve the host name is out of scope for SCTP, so that's not its problem 🙅♀️
Note: at least one null terminator is included in the Host Name string and must be included in the length. don't forget the terminator, bestie 😤
Supported Address Types (12) 🦋
the sender of INIT uses this parameter to list every address type it can support 💖
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 12 | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Address Type #1 | Address Type #2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ...... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-+-++-+-+-+Address Type: 16 bits (unsigned integer) 🌈
this is filled with the type value of the matching address TLV, like IPv4 = 5, IPv6 = 6, Host name = 11 🧚 the table is complete, babe ✨
3.3.3. Initiation Acknowledgement (INIT ACK) (2) 🎀
okay so the INIT ACK chunk is basically the "yes, hi, I got your initiation" reply 💖 used to acknowledge that an SCTP association is starting ✨
its parameter part looks a lot like the INIT chunk's, except it has two extra variable parameters: the State Cookie and the Unrecognized Parameter 🦋 here's the layout:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 2 | Chunk Flags | Chunk Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Initiate Tag |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Advertised Receiver Window Credit |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Number of Outbound Streams | Number of Inbound Streams |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Initial TSN |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
\ \
/ Optional/Variable-Length Parameters /
\ \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Initiate Tag: 32 bits (unsigned integer) 🍓
the receiver of the INIT ACK stores the Initiate Tag value it got. this value MUST be placed into the Verification Tag field of every SCTP packet the INIT ACK receiver sends in this association, no exceptions bestie 💅
the Initiate Tag MUST NOT be 0. check Section 5.3.1 if you want the full scoop on how it gets picked ✨
if a received INIT ACK has an Initiate Tag of 0, the receiver MUST destroy the association and throw away its TCB 💀 the receiver MAY send an ABORT just to help with debugging.
Advertised Receiver Window Credit (a_rwnd): 32 bits (unsigned integer) 🌸
this is how many bytes of buffer space the INIT ACK sender has set aside for this association. it's giving "reserved just for you" energy 🫶 during the whole association, that buffer space SHOULD NOT be shrunk (no taking dedicated buffers away from this association, that's rude 😭).
Number of Outbound Streams (OS): 16 bits (unsigned integer) 🦋
this is how many outbound streams the INIT ACK sender wants to create in this association. the value 0 MUST NOT be used, and it MUST NOT be bigger than the MIS value that came in the INIT chunk 🙈
Note: if a receiver of an INIT ACK sees an OS value of 0, it SHOULD destroy the association and throw away its TCB.
Number of Inbound Streams (MIS): 16 bits (unsigned integer) 🧚
this is the max number of streams the INIT ACK sender lets the peer create in this association. the value 0 MUST NOT be used.
Note: nobody negotiates the actual stream count here. instead, both endpoints use min(requested, offered). see Section 5.1.1 for the deets ✨
Note: if a receiver of an INIT ACK sees a MIS value of 0, it SHOULD destroy the association and throw away its TCB.
Initial TSN (I-TSN): 32 bits (unsigned integer) 🌈
this is the starting TSN the INIT ACK sender is going to use. the valid range is 0 to 4294967295. this field MAY be set to the same value as the Initiate Tag field 👑
here's the fixed and variable parameter rundown:
Fixed Parameters Status
----------------------------------------------
Initiate Tag Mandatory
Advertised Receiver Window Credit Mandatory
Number of Outbound Streams Mandatory
Number of Inbound Streams Mandatory
Initial TSN Mandatory
Variable Parameters Status Type Value
-------------------------------------------------------------
State Cookie Mandatory 7
IPv4 Address (Note 1) Optional 5
IPv6 Address (Note 1) Optional 6
Unrecognized Parameter Optional 8
Reserved for ECN Capable (Note 2) Optional 32768 (0x8000)
Host Name Address (Note 3) Optional 11Note 1: INIT ACK chunks can contain any number of IP address parameters, IPv4 and/or IPv6, in any combination. mix and match, iykyk 🎀
Note 2: the ECN Capable field is reserved for future use of Explicit Congestion Notification 🔥
Note 3: INIT ACK chunks MUST NOT contain more than one Host Name Address parameter. the sender of the INIT ACK MUST NOT mix in any other address types with the Host Name Address, and if the Host Name Address parameter is there, the receiver of the INIT ACK MUST ignore any other address types. main character Host Name energy 👑
IMPLEMENTATION NOTE: an implementation MUST be ready to receive an INIT ACK that's pretty chunky (over 1500 bytes) because the State Cookie and the address list can both be variable size 😭 for example, if a responder to the INIT wants to send 1000 IPv4 addresses, it needs at least 8,000 bytes to encode them in the INIT ACK. that's a lot of addresses bestie 🫠
IMPLEMENTATION NOTE: if an INIT ACK chunk arrives with known parameters that aren't optional for the INIT ACK chunk, the receiver SHOULD still process the INIT ACK and send back a COOKIE ECHO. the receiver of the INIT ACK chunk MAY bundle an ERROR chunk with the COOKIE ECHO chunk. restrictive implementations, though, MAY send back an ABORT chunk in response to the INIT ACK chunk instead 🙅♀️
together with the Source Port in the SCTP common header, each IP Address parameter in the INIT ACK tells the receiver a valid transport address the sender supports for the whole life of the association being started 🧚♀️
if the INIT ACK has at least one IP Address parameter, then the source address of the IP datagram carrying the INIT ACK, plus any extra addresses in the INIT ACK, may be used as destinations by the receiver. if the INIT ACK has no IP Address parameters, the receiver of the INIT ACK MUST use the source address from the received IP datagram as its only destination address for the association 📍
the State Cookie and Unrecognized Parameters both use the Type-Length-Value format from Section 3.2.1, and they're described below. the other fields work exactly like their INIT chunk counterparts 💜
3.3.3.1. Optional or Variable-Length Parameters ✨
State Cookie 🍪
Parameter Type Value: 7
Parameter Length: variable size, depending on how big the Cookie is.
Parameter Value:
this parameter value MUST carry all the necessary state and parameter info the INIT ACK sender needs to create the association, plus a Message Authentication Code (MAC). see Section 5.1.3 for the State Cookie definition 🔐
Unrecognized Parameter 🙈
Parameter Type Value: 8
Parameter Length: variable size.
Parameter Value:
this parameter gets sent back to the originator of the INIT chunk when the INIT had an unrecognized parameter whose value says it should be reported to the sender. the parameter value field contains the unrecognized parameters copied straight from the INIT chunk, complete with their Parameter Type, Length, and Value fields 🌸
3.3.4. Selective Acknowledgement (SACK) (3) 🦋
okay bestie, this is the SACK chunk and it's giving "I got your stuff, here's what's missing." 💅 The sender uses it to acknowledge DATA chunks it has received, and to tell the other endpoint where the holes are in the TSN sequence. 🌸
Every SACK MUST contain the Cumulative TSN Ack, Advertised Receiver Window Credit (a_rwnd), Number of Gap Ack Blocks, and Number of Duplicate TSNs fields. no cap, those four are non-negotiable. 🫶
So the Cumulative TSN Ack is basically the last TSN you got before the sequence broke. The next TSN after that one hasn't reached the endpoint sending the SACK yet. 😭 That means this one number acknowledges every TSN that's less than or equal to it. Iconic efficiency.
How the receiver handles a_rwnd is a whole thing that gets covered in Section 6.2.1, so go check that out if you want the full tea. ☕
The SACK can also carry zero or more Gap Ack Blocks. Each block acknowledges a little run of TSNs that showed up after a break in the sequence. ✨ Every TSN covered by a Gap Ack Block is greater than the Cumulative TSN Ack, so there's no overlap drama. 👑
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 3 |Chunk Flags | Chunk Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Cumulative TSN Ack |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Advertised Receiver Window Credit (a_rwnd) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Number of Gap Ack Blocks = N | Number of Duplicate TSNs = X |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Gap Ack Block #1 Start | Gap Ack Block #1 End |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
/ /
\ ... \
/ /
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Gap Ack Block #N Start | Gap Ack Block #N End |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Duplicate TSN 1 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
/ /
\ ... \
/ /
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Duplicate TSN X |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Chunk Flags: 8 bits 🎀
Set to all '0's on transmit and ignored on receipt. Zero drama, just vibes. 🌈
Cumulative TSN Ack: 32 bits (unsigned integer) 💖
This is the TSN of the last DATA chunk received in sequence before a gap. If no DATA chunk has shown up at all, the value gets set to the peer's Initial TSN minus one. 🧚
Advertised Receiver Window Credit (a_rwnd): 32 bits (unsigned integer) 🍓
This tells the SACK sender how much receive buffer space it has now, in bytes. More details live in Section 6.2.1. ✨
Number of Gap Ack Blocks: 16 bits (unsigned integer) 🌸
Just counts how many Gap Ack Blocks are in this SACK. Simple, clean, iconic. 💅
Number of Duplicate TSNs: 16 bit 🙈
This is how many duplicate TSNs the endpoint has received. Each one gets listed after the Gap Ack Block list. 🦋
Gap Ack Blocks: 🔥
These fields are the Gap Ack Blocks themselves. You repeat them once for each block, up to the number you put in the Number of Gap Ack Blocks field. Any DATA chunk with a TSN that's greater than or equal to (Cumulative TSN Ack + Gap Ack Block Start) and less than or equal to (Cumulative TSN Ack + Gap Ack Block End) for a given block is assumed to have been received correctly. ✅
Gap Ack Block Start: 16 bits (unsigned integer) 💜
This is the start offset TSN for the block. You add the Cumulative TSN Ack to this offset to get the real TSN, and that's the first TSN in the block that's been received. 🌟
Gap Ack Block End: 16 bits (unsigned integer) 🫧
This is the end offset TSN for the block. Add the Cumulative TSN Ack to it and you get the TSN of the last DATA chunk received in that block. 🎯
Okay, now let's do an example, because examples are my love language. 🥰 Say the receiver has these DATA chunks newly arrived at the moment it decides to send a Selective ACK:
----------
| TSN=17 |
----------
| | <- still missing
----------
| TSN=15 |
----------
| TSN=14 |
----------
| | <- still missing
----------
| TSN=12 |
----------
| TSN=11 |
----------
| TSN=10 |
----------Then the parameter part of the SACK MUST be built like this, assuming the sender sets the new a_rwnd to 4660: 👑
+--------------------------------+
| Cumulative TSN Ack = 12 |
+--------------------------------+
| a_rwnd = 4660 |
+----------------+---------------+
| num of block=2 | num of dup=0 |
+----------------+---------------+
|block #1 strt=2 |block #1 end=3 |
+----------------+---------------+
|block #2 strt=5 |block #2 end=5 |
+----------------+---------------+Duplicate TSN: 32 bits (unsigned integer) 👯
This counts how many times a TSN got received as a duplicate since the last SACK went out. Every time a receiver gets a duplicate TSN before sending the SACK, it gets added to the duplicates list. The duplicate count resets to zero after each SACK is sent. 🔄
For example, if the receiver gets TSN 19 three times, it lists 19 twice in the outbound SACK, because the first one isn't a duplicate. ✨ If it gets one more TSN 19 after sending that SACK, then 19 shows up as a duplicate once in the next outgoing SACK. Math ate that. 💀
3.3.5. Heartbeat Request (HEARTBEAT) (4) 💓
An endpoint should send this chunk to its peer to check whether a particular destination transport address defined in the present association is still reachable. 🧚♀️ It's basically a little "hello, you there?" 🌸
The parameter field holds the Heartbeat Information. This is a variable-length opaque data structure, and only the sender understands what's inside it. 🔐 Secret handshake energy. 🤫
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 4 | Chunk Flags | Heartbeat Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
\ \
/ Heartbeat Information TLV (Variable-Length) /
\ \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Chunk Flags: 8 bits 🎀
Set to 0 on transmit and ignored on receipt. ✨
Heartbeat Length: 16 bits (unsigned integer) 🌈
Set this to the size of the chunk in bytes, counting both the chunk header and the Heartbeat Information field. 📏
Heartbeat Information: variable length 💜
This is defined as a variable-length parameter using the format from Section 3.2.1, which looks like this: 🦋
Variable Parameters Status Type Value
-------------------------------------------------------------
Heartbeat Info Mandatory 1 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Heartbeat Info Type=1 | HB Info Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
/ Sender-Specific Heartbeat Info /
\ \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+The Sender-Specific Heartbeat Info field should normally include the sender's current time when this HEARTBEAT chunk goes out, plus the destination transport address it's being sent to (see Section 8.3). ⏰ The receiver simply reflects that info straight back in the HEARTBEAT ACK message (see Section 3.3.6), so the sender can measure things. 📊 Also, HEARTBEAT does double duty: it's used for reachability checking and for path verification (see Section 5.4). 🛤️ When a HEARTBEAT chunk is being used for path verification, it MUST hold a 64-bit random nonce. 🎲 Very important, very random, very serious. 🔥
3.3.6. Heartbeat Acknowledgement (HEARTBEAT ACK) (5) 🫶
An endpoint should send this chunk to its peer as a reply to a HEARTBEAT chunk (see Section 8.3). 💌 A HEARTBEAT ACK always goes back to the source IP address of the IP datagram that carried the HEARTBEAT chunk it's answering. 📬 Bestie, it never gets lost in the mail.
The parameter field holds a variable-length opaque data structure. 🎁
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 5 | Chunk Flags | Heartbeat Ack Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
\ \
/ Heartbeat Information TLV (Variable-Length) /
\ \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Chunk Flags: 8 bits 🎀
Set to 0 on transmit and ignored on receipt. 🌸
Heartbeat Ack Length: 16 bits (unsigned integer) 📏
Set this to the size of the chunk in bytes, counting both the chunk header and the Heartbeat Information field. ✨
Heartbeat Information: variable length 💖
This field MUST contain the Heartbeat Information parameter from the Heartbeat Request it's responding to. No swapping, no editing, just a perfect mirror. 🪞
Variable Parameters Status Type Value
-------------------------------------------------------------
Heartbeat Info Mandatory 13.3.7. Abort Association (ABORT) (6) 🛑
okay so the ABORT chunk is how you slam the door on an association with your peer 🚪💥 it can carry Cause Parameters to tell the receiver why it's happening. DATA chunks MUST NOT be bundled with ABORT 🙅♀️ Control chunks (except for INIT, INIT ACK, and SHUTDOWN COMPLETE) MAY be bundled with an ABORT, but they MUST be placed before the ABORT in the SCTP packet or they'll get ignored by the receiver. order matters, bestie 💅
if an endpoint gets an ABORT with a format error or no TCB is found, it MUST silently discard it 🤫 and under any circumstances, an endpoint that receives an ABORT MUST NOT respond to that ABORT by sending an ABORT of its own. no ABORT ping pong, periodt 🏓🚫
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 6 |Reserved |T| Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
\ \
/ zero or more Error Causes /
\ \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Chunk Flags: 8 bits 🏳️
- Reserved: 7 bits: set to 0 on transmit and ignored on receipt.
- T bit: 1 bit: the T bit is set to 0 if the sender filled in the Verification Tag expected by the peer. If the Verification Tag is reflected, the T bit MUST be set to 1. Reflecting just means the sent Verification Tag is the same as the received one. 🪞
Note: special rules apply to this chunk for verification, so check out Section 8.5.1 for the details. 👀
Length: 16 bits (unsigned integer) 📏
Set to the size of the chunk in bytes, including the chunk header and all the Error Cause fields present.
See Section 3.3.10 for Error Cause definitions. 📖
3.3.8. Shutdown Association (SHUTDOWN) (7) 👋
an endpoint in an association MUST use this chunk to start a graceful close of the association with its peer 🫶 it's the polite exit, no drama. here's the format:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 7 | Chunk Flags | Length = 8 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Cumulative TSN Ack |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Chunk Flags: 8 bits 🏳️ set to 0 on transmit and ignored on receipt.
Length: 16 bits (unsigned integer) 📏 indicates the length of the parameter. Set to 8.
Cumulative TSN Ack: 32 bits (unsigned integer) 🔢 this parameter contains the TSN of the last chunk received in sequence before any gaps.
Note: since the SHUTDOWN message doesn't contain Gap Ack Blocks, it can't be used to acknowledge TSNs received out of order. In a SACK, a lack of Gap Ack Blocks that were previously included means the data receiver reneged on the associated DATA chunks. Since SHUTDOWN doesn't contain Gap Ack Blocks, the receiver of the SHUTDOWN shouldn't interpret the lack of a Gap Ack Block as a renege. (See Section 6.2 for info on reneging.) 🧐
3.3.9. Shutdown Acknowledgement (SHUTDOWN ACK) (8) 🤝
this chunk MUST be used to acknowledge receipt of the SHUTDOWN chunk at the end of the shutdown process; see Section 9.2 for details. ✅
the SHUTDOWN ACK chunk has no parameters. 🫙
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 8 |Chunk Flags | Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Chunk Flags: 8 bits 🏳️ set to 0 on transmit and ignored on receipt.
3.3.10. Operation Error (ERROR) (9) 🚨
an endpoint sends this chunk to its peer to say "hey, something's up" 👀 it holds one or more error causes. an Operation Error isn't fatal on its own, but it can be paired with an ABORT chunk to report a fatal condition. it has these parameters:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 9 | Chunk Flags | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
\ \
/ one or more Error Causes /
\ \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Chunk Flags: 8 bits 🏳️ set to 0 on transmit and ignored on receipt.
Length: 16 bits (unsigned integer) 📏 set to the size of the chunk in bytes, including the chunk header and all the Error Cause fields present.
error causes are defined as variable-length parameters using the format from Section 3.2.1, which looks like this: 🧩
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Cause Code | Cause Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
/ Cause-Specific Information /
\ \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Cause Code: 16 bits (unsigned integer) 🏷️ defines the type of error being reported.
Cause Code
Value Cause Code
--------- ----------------
1 Invalid Stream Identifier
2 Missing Mandatory Parameter
3 Stale Cookie Error
4 Out of Resource
5 Unresolvable Address
6 Unrecognized Chunk Type
7 Invalid Mandatory Parameter
8 Unrecognized Parameters
9 No User Data
10 Cookie Received While Shutting Down
11 Restart of an Association with New Addresses
12 User Initiated Abort
13 Protocol ViolationCause Length: 16 bits (unsigned integer) 📐 set to the size of the parameter in bytes, including the Cause Code, Cause Length, and Cause-Specific Information fields.
Cause-Specific Information: variable length 🎁 this field carries the details of the error condition.
Section 3.3.10.1 through Section 3.3.10.13 define the error causes for SCTP. If the IETF wants to define new error cause values, the guidelines are in Section 14.3. 🗂️
3.3.10.1. Invalid Stream Identifier (1) 🚫
Cause of error
Invalid Stream Identifier: the endpoint got a DATA chunk sent to a stream that doesn't exist. 👻
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Cause Code=1 | Cause Length=8 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Stream Identifier | (Reserved) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Stream Identifier: 16 bits (unsigned integer) 🔢 contains the Stream Identifier of the DATA chunk that was received in error.
Reserved: 16 bits 🚧 this field is reserved. It's set to all 0's on transmit and ignored on receipt.
3.3.10.2. Missing Mandatory Parameter (2) 🧩
Cause of error
Missing Mandatory Parameter: says one or more mandatory TLV parameters are missing from a received INIT or INIT ACK. 🕵️♀️
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Cause Code=2 | Cause Length=8+N*2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Number of missing params=N |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Missing Param Type #1 | Missing Param Type #2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Missing Param Type #N-1 | Missing Param Type #N |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Number of Missing params: 32 bits (unsigned integer) 🔢 this field contains the number of parameters in the Cause-Specific Information field.
Missing Param Type: 16 bits (unsigned integer) 🏷️ each field contains the missing mandatory parameter number.
3.3.10.3. Stale Cookie Error (3) 🍪
Cause of error
Stale Cookie Error: says a valid State Cookie was received, but it has expired. 🥛
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Cause Code=3 | Cause Length=8 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Measure of Staleness (usec.) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Measure of Staleness: 32 bits (unsigned integer) ⏱️ this field contains the difference, in microseconds, between the current time and the time the State Cookie expired.
The sender of this error cause MAY choose to report how long past expiration the State Cookie is by including a non-zero value in the Measure of Staleness field. If the sender doesn't wish to share that info, it should set the Measure of Staleness field to zero. 🤷♀️
3.3.10.4. Out of Resource (4) 🪫
Cause of error
Out of Resource: says the sender is out of resources. This is usually sent in combination with or within an ABORT. 😮💨
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Cause Code=4 | Cause Length=4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+3.3.10.5. Unresolvable Address (5) 🗺️
Cause of error
Unresolvable Address: says the sender can't resolve the specified address parameter (for example, the sender doesn't support that address type). This is usually sent in combination with or within an ABORT. 🙃
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Cause Code=5 | Cause Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
/ Unresolvable Address /
\ \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Unresolvable Address: variable length 🏠 the Unresolvable Address field contains the complete Type, Length, and Value of the address parameter (or Host Name parameter) that holds the unresolvable address or host name.
3.3.10.6. Unrecognized Chunk Type (6) 🦋
Cause of error 💀
Okay so Unrecognized Chunk Type is the error that gets sent back to whoever sent a chunk when the receiver doesn't understand it, and the upper bits of the 'Chunk Type' are set to 01 or 11 🫶
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Cause Code=6 | Cause Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
/ Unrecognized Chunk /
\ \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Unrecognized Chunk: variable length ✨
The Unrecognized Chunk field holds the unrecognized chunk from the SCTP packet, complete with its Chunk Type, Chunk Flags, and Chunk Length. 🎀
3.3.10.7. Invalid Mandatory Parameter (7) 💅
Cause of error 💀
Invalid Mandatory Parameter is returned to the originator of an INIT or INIT ACK chunk when one of the mandatory parameters is set to an invalid value. It's giving strict 🙈
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Cause Code=7 | Cause Length=4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+3.3.10.8. Unrecognized Parameters (8) 🌈
Cause of error 💀
Unrecognized Parameters is returned to the originator of the INIT ACK chunk if the receiver doesn't recognize one or more Optional TLV parameters in the INIT ACK chunk. 🧚
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Cause Code=8 | Cause Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
/ Unrecognized Parameters /
\ \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Unrecognized Parameters: variable length
The Unrecognized Parameters field holds the unrecognized parameters copied from the INIT ACK chunk, complete with TLV. This error cause is normally contained in an ERROR chunk bundled with the COOKIE ECHO chunk when responding to the INIT ACK, when the sender of the COOKIE ECHO chunk wishes to report unrecognized parameters. 🫶
3.3.10.9. No User Data (9) 🍓
Cause of error 💀
No User Data is returned to the originator of a DATA chunk if a received DATA chunk has no user data. Bestie, that's a whole mood 😭
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Cause Code=9 | Cause Length=8 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
/ TSN value /
\ \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+TSN value: 32 bits (unsigned integer)
The TSN value field contains the TSN of the DATA chunk that was received with no user data field. ✨
This cause code is normally returned in an ABORT chunk (see Section 6.2). 💖
3.3.10.10. Cookie Received While Shutting Down (10) 🌸
Cause of error 💀
Cookie Received While Shutting Down is the one for when a COOKIE ECHO was received while the endpoint was in the SHUTDOWN-ACK-SENT state. This error is usually returned in an ERROR chunk bundled with the retransmitted SHUTDOWN ACK. Not me being dramatic, but this one is iconic 👑
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Cause Code=10 | Cause Length=4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+3.3.10.11. Restart of an Association with New Addresses (11) 🦋
Cause of error 💀
Restart of an association with new addresses happens when an INIT is received on an existing association. But the INIT added addresses to the association that were previously NOT part of the association. The new addresses are listed in the error code. This ERROR is normally sent as part of an ABORT refusing the INIT (see Section 5.2). Main character energy, but make it a new address 🙈
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Cause Code=11 | Cause Length=Variable |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
/ New Address TLVs /
\ \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Note: Each New Address TLV is an exact copy of the TLV that was found in the INIT chunk that was new, including the Parameter Type and the Parameter Length. 💜
3.3.10.12. User-Initiated Abort (12) 💅
Cause of error 💀
This error cause MAY be included in ABORT chunks that are sent because of an upper-layer request. The upper layer can specify an Upper Layer Abort Reason that is transported by SCTP transparently and MAY be delivered to the upper-layer protocol at the peer. Lowkey the most transparent little messenger ever 🫶
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Cause Code=12 | Cause Length=Variable |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
/ Upper Layer Abort Reason /
\ \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+3.3.10.13. Protocol Violation (13) 🔥
Cause of error 💀
This error cause MAY be included in ABORT chunks that are sent because an SCTP endpoint detects a protocol violation of the peer that is not covered by the error causes described in Section 3.3.10.1 to Section 3.3.10.12. An implementation MAY provide additional information specifying what kind of protocol violation has been detected. 🎀
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Cause Code=13 | Cause Length=Variable |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
/ Additional Information /
\ \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+3.3.11. Cookie Echo (COOKIE ECHO) (10) 🧚
This chunk is used only during the initialization of an association. It's sent by the initiator of an association to its peer to complete the initialization process. This chunk MUST precede any DATA chunk sent within the association, but MAY be bundled with one or more DATA chunks in the same packet. Order matters, bestie 💖
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 10 |Chunk Flags | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
/ Cookie /
\ \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Chunk Flags: 8 bit
Set to 0 on transmit and ignored on receipt. 🌈
Length: 16 bits (unsigned integer)
Set to the size of the chunk in bytes, including the 4 bytes of the chunk header and the size of the cookie. ✨
Cookie: variable size
This field must contain the exact cookie received in the State Cookie parameter from the previous INIT ACK. 🫶
An implementation SHOULD make the cookie as small as possible to ensure interoperability. 🌸
Note: A Cookie Echo does NOT contain a State Cookie parameter; instead, the data within the State Cookie's Parameter Value becomes the data within the Cookie Echo's Chunk Value. This allows an implementation to change only the first 2 bytes of the State Cookie parameter to become a COOKIE ECHO chunk. Such a glow-up, honestly 🦋
3.3.12. Cookie Acknowledgement (COOKIE ACK) (11) 💅
This chunk is used only during the initialization of an association. It is used to acknowledge the receipt of a COOKIE ECHO chunk. This chunk MUST precede any DATA or SACK chunk sent within the association, but MAY be bundled with one or more DATA chunks or SACK chunk's in the same SCTP packet. ✨
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 11 |Chunk Flags | Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Chunk Flags: 8 bits
Set to 0 on transmit and ignored on receipt. 💜
3.3.13. Shutdown Complete (SHUTDOWN COMPLETE) (14) 🌈
This chunk MUST be used to acknowledge the receipt of the SHUTDOWN ACK chunk at the completion of the shutdown process; see Section 9.2 for details. Closing the chat properly, iykyk 🎀
The SHUTDOWN COMPLETE chunk has no parameters. 🧚
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 14 |Reserved |T| Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Chunk Flags: 8 bits
Reserved: 7 bits
Set to 0 on transmit and ignored on receipt. 🍓
T bit: 1 bit
The T bit is set to 0 if the sender filled in the Verification Tag expected by the peer. If the Verification Tag is reflected, the T bit MUST be set to 1. Reflecting means that the sent Verification Tag is the same as the received one. ✨
Note: Special rules apply to this chunk for verification, please see Section 8.5.1 for details. Verification is serious business, so read that section, no cap 🫶
4. SCTP Association State Diagram ✨
okay so 🦋 over the life of an SCTP association, each endpoint's association keeps hopping from one state to another depending on what's happening. the events that can move an association's state along are:
- SCTP user primitive calls, e.g., [ASSOCIATE], [SHUTDOWN], [ABORT],
- Reception of INIT, COOKIE ECHO, ABORT, SHUTDOWN, etc., control chunks, or
- Some timeout events.
the diagram below shows the state changes, along with what causes them and what happens next 💅. heads up that some error conditions aren't drawn in the diagram, so the text has the full scoop on every special case 🙈
Note: chunk names are ALL CAPS, while parameter names only capitalize the first letter, e.g., COOKIE ECHO chunk type vs. State Cookie parameter 💜 if more than one event or message can cause the same state transition, it gets labeled (A), (B), and so on.
----- -------- (from any state)
/ \ / rcv ABORT [ABORT]
rcv INIT | | | ---------- or ----------
--------------- | v v delete TCB snd ABORT
generate Cookie \ +---------+ delete TCB
snd INIT ACK ---| CLOSED |
+---------+
/ \ [ASSOCIATE]
/ \ ---------------
| | create TCB
| | snd INIT
| | strt init timer
rcv valid | |
COOKIE ECHO | v
(1) ---------------- | +------------+
create TCB | | COOKIE-WAIT| (2)
snd COOKIE ACK | +------------+
| |
| | rcv INIT ACK
| | -----------------
| | snd COOKIE ECHO
| | stop init timer
| | strt cookie timer
| v
| +--------------+
| | COOKIE-ECHOED| (3)
| +--------------+
| |
| | rcv COOKIE ACK
| | -----------------
| | stop cookie timer
v v
+---------------+
| ESTABLISHED |
+---------------+
(from the ESTABLISHED state only)
|
|
/--------+--------\
[SHUTDOWN] / \
-------------------| |
check outstanding | |
DATA chunks | |
v |
+---------+ |
|SHUTDOWN-| | rcv SHUTDOWN
|PENDING | |------------------
+---------+ | check outstanding
| | DATA chunks
No more outstanding | |
---------------------| |
snd SHUTDOWN | |
strt shutdown timer | |
v v
+---------+ +-----------+
(4) |SHUTDOWN-| | SHUTDOWN- | (5,6)
|SENT | | RECEIVED |
+---------+ +-----------+
| \ |
(A) rcv SHUTDOWN ACK | \ |
---------------------| \ |
stop shutdown timer | \rcv:SHUTDOWN |
send SHUTDOWN COMPLETE| \ (B) |
delete TCB | \ |
| \ | No more outstanding
| \ |-----------------
| \ | send SHUTDOWN ACK
(B)rcv SHUTDOWN | \ | strt shutdown timer
---------------------| \ |
send SHUTDOWN ACK | \ |
start shutdown timer | \ |
move to SHUTDOWN- | \ |
ACK-SENT | | |
| v |
| +-----------+
| | SHUTDOWN- | (7)
| | ACK-SENT |
| +----------+-
| | (C)rcv SHUTDOWN COMPLETE
| |-----------------
| | stop shutdown timer
| | delete TCB
| |
| | (D)rcv SHUTDOWN ACK
| |--------------
| | stop shutdown timer
| | send SHUTDOWN COMPLETE
| | delete TCB
| |
\ +---------+ /
\-->| CLOSED |<--/
+---------+
Figure 3: State Transition Diagram of SCTPNotes:
- okay, so if the State Cookie in the received COOKIE ECHO fails the integrity check, the receiver MUST silently discard the packet 🙈 and if the State Cookie is expired (see Section 5.1.5), the receiver MUST send back an ERROR chunk. either way, the receiver stays in the CLOSED state 💜
- if the T1-init timer expires, the endpoint MUST retransmit INIT and restart the T1-init timer without changing state 🦋 this MUST be repeated up to 'Max.Init.Retransmits' times. after that, the endpoint MUST abort the initialization process and report the error to the SCTP user 😭
- if the T1-cookie timer expires, the endpoint MUST retransmit COOKIE ECHO and restart the T1-cookie timer without changing state. this MUST be repeated up to 'Max.Init.Retransmits' times. after that, the endpoint MUST abort the initialization process and report the error to the SCTP user 💀
- in the SHUTDOWN-SENT state, the endpoint MUST acknowledge any received DATA chunks without delay 🫶
- in the SHUTDOWN-RECEIVED state, the endpoint MUST NOT accept any new send requests from its SCTP user 🚫
- also in the SHUTDOWN-RECEIVED state, the endpoint MUST transmit or retransmit data and leave this state when all data in queue is transmitted 🔥
- in the SHUTDOWN-ACK-SENT state, the endpoint MUST NOT accept any new send requests from its SCTP user 🎀
the CLOSED state just means the association isn't created (i.e., doesn't exist) 🧚
5. Association Initialization 🌸
before any data can move from one SCTP endpoint ("A") to another SCTP endpoint ("Z"), the two endpoints have to finish an initialization process so they can set up an SCTP association between them 🎀
the SCTP user at an endpoint should use the ASSOCIATE primitive to initialize an SCTP association to another SCTP endpoint 💅
IMPLEMENTATION NOTE: from an SCTP user's point of view, an association may be implicitly opened, without an ASSOCIATE primitive (see Section 10.1 B) being invoked, by the initiating endpoint's sending of the first user data to the destination endpoint 👑 the initiating SCTP will assume default values for all mandatory and optional parameters for the INIT/INIT ACK. no cap, that's a whole vibe ✨
once the association is established, unidirectional streams are open for data transfer on both ends (see Section 5.1.1) 🌈
5.1. Normal Establishment of an Association ✨
okay so here's how the handshake goes 🤝 (picture endpoint "A" trying to set up an association with endpoint "Z", and "Z" says yes 💖):
A) okay so first, "A" sends an INIT chunk to "Z" 💌. In the INIT, "A" must provide its Verification Tag (Tag_A) in the Initiate Tag field. Tag_A SHOULD be a random number in the range of 1 to 4294967295 (see Section 5.3.1 for Tag value selection). After sending the INIT, "A" starts the T1-init timer and enters the COOKIE-WAIT state. 🫶
B) "Z" shall respond immediately with an INIT ACK chunk 🏃♀️. The destination IP address of the INIT ACK MUST be set to the source IP address of the INIT to which this INIT ACK is responding. In the response, besides filling in other parameters, "Z" must set the Verification Tag field to Tag_A, and also provide its own Verification Tag (Tag_Z) in the Initiate Tag field.
Moreover, "Z" MUST generate and send along with the INIT ACK a State Cookie 🍪. See Section 5.1.3 for State Cookie generation.
Note: After sending out INIT ACK with the State Cookie parameter, "Z" MUST NOT allocate any resources or keep any states for the new association. Otherwise, "Z" will be vulnerable to resource attacks.
🚨 bestie, this is the important bit! "Z" can't hold onto anything for the new association yet, or it's wide open to resource attacks. Not cute 💀
C) okay, when "A" gets the INIT ACK from "Z", "A" shall stop the T1-init timer and leave the COOKIE-WAIT state. "A" shall then send the State Cookie received in the INIT ACK chunk in a COOKIE ECHO chunk, start the T1-cookie timer, and enter the COOKIE-ECHOED state. 🍪✨
Note: The COOKIE ECHO chunk can be bundled with any pending outbound DATA chunks, but it MUST be the first chunk in the packet, and until the COOKIE ACK is returned the sender MUST NOT send any other packets to the peer. 🙈
D) once "Z" gets the COOKIE ECHO chunk, "Z" will reply with a COOKIE ACK chunk after building a TCB and moving to the ESTABLISHED state 👑. A COOKIE ACK chunk may be bundled with any pending DATA chunks (and/or SACK chunks), but the COOKIE ACK chunk MUST be the first chunk in the packet. 💅
IMPLEMENTATION NOTE: An implementation may choose to send the Communication Up notification to the SCTP user upon reception of a valid COOKIE ECHO chunk. 🌸
E) when "A" gets the COOKIE ACK, "A" will move from the COOKIE-ECHOED state to the ESTABLISHED state and stop the T1-cookie timer 🎉. It may also notify its ULP about the successful establishment of the association with a Communication Up notification (see Section 10).
An INIT or INIT ACK chunk MUST NOT be bundled with any other chunk. They MUST be the only chunks present in the SCTP packets that carry them. 🚫
An endpoint MUST send the INIT ACK to the IP address from which it received the INIT. 📬
Note: T1-init timer and T1-cookie timer shall follow the same rules given in Section 6.3. ⏰
If an endpoint receives an INIT, INIT ACK, or COOKIE ECHO chunk but decides not to establish the new association due to missing mandatory parameters in the received INIT or INIT ACK, invalid parameter values, or lack of local resources, it SHOULD respond with an ABORT chunk. It SHOULD also specify the cause of abort, such as the type of the missing mandatory parameters, etc., by including the error cause parameters with the ABORT chunk. The Verification Tag field in the common header of the outbound SCTP packet containing the ABORT chunk MUST be set to the Initiate Tag value of the peer. 🙅♀️
Note that a COOKIE ECHO chunk that does NOT pass the integrity check is NOT considered an 'invalid parameter' and requires special handling; see Section 5.1.5. 🔐
After the reception of the first DATA chunk in an association the endpoint MUST immediately respond with a SACK to acknowledge the DATA chunk. Subsequent acknowledgements should be done as described in Section 6.2. 💌
When the TCB is created, each endpoint MUST set its internal Cumulative TSN Ack Point to the value of its transmitted Initial TSN minus one. 🧮
IMPLEMENTATION NOTE: The IP addresses and SCTP port are generally used as the key to find the TCB within an SCTP instance. 🔑
5.1.1. Handle Stream Parameters 🌊
okay, stream parameters time! In the INIT and INIT ACK chunks, the sender of the chunk MUST indicate the number of outbound streams (OSs) it wishes to have in the association, as well as the maximum inbound streams (MISs) it will accept from the other endpoint. 🙋♀️
After receiving the stream configuration information from the other side, each endpoint MUST perform the following check: If the peer's MIS is less than the endpoint's OS, meaning that the peer is incapable of supporting all the outbound streams the endpoint wants to configure, the endpoint MUST use MIS outbound streams and MAY report any shortage to the upper layer. The upper layer can then choose to abort the association if the resource shortage is unacceptable. 🤔
After the association is initialized, the valid outbound stream identifier range for either endpoint shall be 0 to min(local OS, remote MIS)-1. 🔢
5.1.2. Handle Address Parameters 📍
so during association initialization, an endpoint shall use the following rules to discover and collect the destination transport address(es) of its peer. 🗺️
A) If there are no address parameters present in the received INIT or INIT ACK chunk, the endpoint shall take the source IP address from which the chunk arrives and record it, in combination with the SCTP source port number, as the only destination transport address for this peer. 🎯
B) If there is a Host Name parameter present in the received INIT or INIT ACK chunk, the endpoint shall resolve that host name to a list of IP address(es) and derive the transport address(es) of this peer by combining the resolved IP address(es) with the SCTP source port.
The endpoint MUST ignore any other IP Address parameters if they are also present in the received INIT or INIT ACK chunk. 🙃
The time at which the receiver of an INIT resolves the host name has potential security implications to SCTP. If the receiver of an INIT resolves the host name upon the reception of the chunk, and the mechanism the receiver uses to resolve the host name involves potential long delay (e.g., DNS query), the receiver may open itself up to resource attacks for the period of time while it is waiting for the name resolution results before it can build the State Cookie and release local resources. 😱
🚨 this one's serious, babe! a slow DNS lookup could give attackers a window to mess with the receiver's resources. Be careful about when you resolve that name!
Therefore, in cases where the name translation involves potential long delay, the receiver of the INIT MUST postpone the name resolution till the reception of the COOKIE ECHO chunk from the peer. In such a case, the receiver of the INIT SHOULD build the State Cookie using the received Host Name (instead of destination transport addresses) and send the INIT ACK to the source IP address from which the INIT was received. 🕰️
The receiver of an INIT ACK shall always immediately attempt to resolve the name upon the reception of the chunk. 🏃♀️
The receiver of the INIT or INIT ACK MUST NOT send user data (piggy-backed or stand-alone) to its peer until the host name is successfully resolved. 🚫📦
If the name resolution is not successful, the endpoint MUST immediately send an ABORT with "Unresolvable Address" error cause to its peer. The ABORT shall be sent to the source IP address from which the last peer packet was received. 💔
C) If there are only IPv4/IPv6 addresses present in the received INIT or INIT ACK chunk, the receiver MUST derive and record all the transport addresses from the received chunk AND the source IP address that sent the INIT or INIT ACK. The transport addresses are derived by the combination of SCTP source port (from the common header) and the IP Address parameter(s) carried in the INIT or INIT ACK chunk and the source IP address of the IP datagram. The receiver should use only these transport addresses as destination transport addresses when sending subsequent packets to its peer. 🧭
D) An INIT or INIT ACK chunk MUST be treated as belonging to an already established association (or one in the process of being established) if the use of any of the valid address parameters contained within the chunk would identify an existing TCB. 👀
IMPLEMENTATION NOTE: In some cases (e.g., when the implementation doesn't control the source IP address that is used for transmitting), an endpoint might need to include in its INIT or INIT ACK all possible IP addresses from which packets to the peer could be transmitted. 🌐
After all transport addresses are derived from the INIT or INIT ACK chunk using the above rules, the endpoint shall select one of the transport addresses as the initial primary path. 🛣️✨
Note: The INIT ACK MUST be sent to the source address of the INIT. 📬
The sender of INIT may include a 'Supported Address Types' parameter in the INIT to indicate what types of address are acceptable. When this parameter is present, the receiver of INIT (initiate) MUST either use one of the address types indicated in the Supported Address Types parameter when responding to the INIT, or abort the association with an "Unresolvable Address" error cause if it is unwilling or incapable of using any of the address types indicated by its peer. 💁♀️
IMPLEMENTATION NOTE: In the case that the receiver of an INIT ACK fails to resolve the address parameter due to an unsupported type, it can abort the initiation process and then attempt a reinitiation by using a 'Supported Address Types' parameter in the new INIT to indicate what types of address it prefers. 🔄
IMPLEMENTATION NOTE: If an SCTP endpoint that only supports either IPv4 or IPv6 receives IPv4 and IPv6 addresses in an INIT or INIT ACK chunk from its peer, it MUST use all the addresses belonging to the supported address family. The other addresses MAY be ignored. The endpoint SHOULD NOT respond with any kind of error indication. 🙌
IMPLEMENTATION NOTE: If an SCTP endpoint lists in the 'Supported Address Types' parameter either IPv4 or IPv6, but uses the other family for sending the packet containing the INIT chunk, or if it also lists addresses of the other family in the INIT chunk, then the address family that is not listed in the 'Supported Address Types' parameter SHOULD also be considered as supported by the receiver of the INIT chunk. The receiver of the INIT chunk SHOULD NOT respond with any kind of error indication. 💖
5.1.3. Generating State Cookie 🍪
okay so when an INIT ACK is going out as the reply to an INIT chunk, the sender of that INIT ACK makes a State Cookie and drops it into the State Cookie parameter of the INIT ACK 💌. Inside that cookie, the sender should put a MAC (check [RFC2104] for an example), a timestamp for when the State Cookie got made, and its lifespan, plus everything it needs to set up the association later. bestie this is giving packing a survival kit 🧳✨
The following steps SHOULD be taken to generate the State Cookie:
- Create an association TCB using information from both the received INIT and the outgoing INIT ACK chunk,
- In the TCB, set the creation time to the current time of day, and the lifespan to the protocol parameter 'Valid.Cookie.Life' (see Section 15),
- From the TCB, identify and collect the minimal subset of information needed to re-create the TCB, and generate a MAC using this subset of information and a secret key (see [RFC2104] for an example of generating a MAC), and
- Generate the State Cookie by combining this subset of information and the resultant MAC.
After sending the INIT ACK with the State Cookie parameter, the sender SHOULD delete the TCB and any other local resource related to the new association, so as to prevent resource attacks. 🛡️ no hoarding the TCB, we're letting it go 💅
The hashing method used to generate the MAC is strictly a private matter for the receiver of the INIT chunk. The use of a MAC is mandatory to prevent denial-of-service attacks. The secret key SHOULD be random ([RFC4086] provides some information on randomness guidelines); it SHOULD be changed reasonably frequently, and the timestamp in the State Cookie MAY be used to determine which key should be used to verify the MAC. the receiver gets to pick its own hashing method, nobody else's business 🫶
An implementation SHOULD make the cookie as small as possible to ensure interoperability. 🎀
5.1.4. State Cookie Processing 📬
When an endpoint (in the COOKIE-WAIT state) receives an INIT ACK chunk with a State Cookie parameter, it MUST immediately send a COOKIE ECHO chunk to its peer with the received State Cookie. The sender MAY also add any pending DATA chunks to the packet after the COOKIE ECHO chunk. 🚀
The endpoint shall also start the T1-cookie timer after sending out the COOKIE ECHO chunk. If the timer expires, the endpoint shall retransmit the COOKIE ECHO chunk and restart the T1-cookie timer. This is repeated until either a COOKIE ACK is received or 'Max.Init.Retransmits' (see Section 15) is reached causing the peer endpoint to be marked unreachable (and thus the association enters the CLOSED state). 💀 so it keeps knocking until it gets an answer or gives up
5.1.5. State Cookie Authentication 🔐
When an endpoint receives a COOKIE ECHO chunk from another endpoint with which it has no association, it shall take the following actions:
- Compute a MAC using the TCB data carried in the State Cookie and the secret key (note the timestamp in the State Cookie MAY be used to determine which secret key to use). [RFC2104] can be used as a guideline for generating the MAC,
- Authenticate the State Cookie as one that it previously generated by comparing the computed MAC against the one carried in the State Cookie. If this comparison fails, the SCTP packet, including the COOKIE ECHO and any DATA chunks, should be silently discarded,
- Compare the port numbers and the Verification Tag contained within the COOKIE ECHO chunk to the actual port numbers and the Verification Tag within the SCTP common header of the received packet. If these values do not match, the packet MUST be silently discarded.
- Compare the creation timestamp in the State Cookie to the current local time. If the elapsed time is longer than the lifespan carried in the State Cookie, then the packet, including the COOKIE ECHO and any attached DATA chunks, SHOULD be discarded, and the endpoint MUST transmit an ERROR chunk with a "Stale Cookie" error cause to the peer endpoint.
- If the State Cookie is valid, create an association to the sender of the COOKIE ECHO chunk with the information in the TCB data carried in the COOKIE ECHO and enter the ESTABLISHED state.
- Send a COOKIE ACK chunk to the peer acknowledging receipt of the COOKIE ECHO. The COOKIE ACK MAY be bundled with an outbound DATA chunk or SACK chunk; however, the COOKIE ACK MUST be the first chunk in the SCTP packet.
- Immediately acknowledge any DATA chunk bundled with the COOKIE ECHO with a SACK (subsequent DATA chunk acknowledgement should follow the rules defined in Section 6.2). As mentioned in step 6, if the SACK is bundled with the COOKIE ACK, the COOKIE ACK MUST appear first in the SCTP packet. ✨ COOKIE ACK always goes first, periodt 💖
If a COOKIE ECHO is received from an endpoint with which the receiver of the COOKIE ECHO has an existing association, the procedures in Section 5.2 should be followed. 👀
5.1.6. An Example of Normal Association Establishment 🧚
okay this example is so satisfying 🥹 "A" starts the association, then sends a user message to "Z", and then "Z" sends two user messages back to "A" later (assuming no bundling or fragmentation happens):
Endpoint A Endpoint Z
{app sets association with Z}
(build TCB)
INIT [I-Tag=Tag_A
& other info] ------\
(Start T1-init timer) \
(Enter COOKIE-WAIT state) \---> (compose temp TCB and Cookie_Z)
/-- INIT ACK [Veri Tag=Tag_A,
/ I-Tag=Tag_Z,
(Cancel T1-init timer) <------/ Cookie_Z, & other info]
(destroy temp TCB)
COOKIE ECHO [Cookie_Z] ------\
(Start T1-init timer) \
(Enter COOKIE-ECHOED state) \---> (build TCB enter ESTABLISHED
state)
/---- COOKIE-ACK
/
(Cancel T1-init timer, <-----/
Enter ESTABLISHED state)
{app sends 1st user data; strm 0}
DATA [TSN=initial TSN_A
Strm=0,Seq=0 & user data]--\
(Start T3-rtx timer) \
\->
/----- SACK [TSN Ack=init
/ TSN_A,Block=0]
(Cancel T3-rtx timer) <------/
...
{app sends 2 messages;strm 0}
/---- DATA
/ [TSN=init TSN_Z
<--/ Strm=0,Seq=0 & user data 1]
SACK [TSN Ack=init TSN_Z, /---- DATA
Block=0] --------\ / [TSN=init TSN_Z +1,
\/ Strm=0,Seq=1 & user data 2]
<------/\
\
\------>Figure 4: INITIATION Example
If the T1-init timer expires at "A" after the INIT or COOKIE ECHO chunks are sent, the same INIT or COOKIE ECHO chunk with the same Initiate Tag (i.e., Tag_A) or State Cookie shall be retransmitted and the timer restarted. This shall be repeated Max.Init.Retransmits times before "A" considers "Z" unreachable and reports the failure to its upper layer (and thus the association enters the CLOSED state). 🫠
When retransmitting the INIT, the endpoint MUST follow the rules defined in Section 6.3 to determine the proper timer value. ⏱️
5.2. Handle Duplicate or Unexpected INIT, INIT ACK, COOKIE ECHO, and COOKIE ACK 🧩
during the life time of an association (in any of the possible states), an endpoint may get one of the setup chunks (INIT, INIT ACK, COOKIE ECHO, and COOKIE ACK) from its peer. the receiver shall treat that setup chunk as a duplicate and process it as described in this section. it's giving déjà vu 🌀
Note: An endpoint will not receive the chunk unless the chunk was sent to an SCTP transport address and is from an SCTP transport address associated with this endpoint. Therefore, the endpoint processes such a chunk as part of its current association. 📍
The following scenarios can cause duplicated or unexpected chunks:
- A) The peer has crashed without being detected, restarted itself, and sent out a new INIT chunk trying to restore the association,
- B) Both sides are trying to initialize the association at about the same time,
- C) The chunk is from a stale packet that was used to establish the present association or a past association that is no longer in existence,
- D) The chunk is a false packet generated by an attacker, or
- E) The peer never received the COOKIE ACK and is retransmitting its COOKIE ECHO.
The rules in the following sections shall be applied in order to identify and correctly handle these cases. 📋
5.2.1. INIT Received in COOKIE-WAIT or COOKIE-ECHOED State (Item B) 💞
This usually indicates an initialization collision, i.e., each endpoint is attempting, at about the same time, to establish an association with the other endpoint. two endpoints lowkey tripping over each other 😭
Upon receipt of an INIT in the COOKIE-WAIT state, an endpoint MUST respond with an INIT ACK using the same parameters it sent in its original INIT chunk (including its Initiate Tag, unchanged). When responding, the endpoint MUST send the INIT ACK back to the same address that the original INIT (sent by this endpoint) was sent. 🔁
Upon receipt of an INIT in the COOKIE-ECHOED state, an endpoint MUST respond with an INIT ACK using the same parameters it sent in its original INIT chunk (including its Initiate Tag, unchanged), provided that no NEW address has been added to the forming association. If the INIT message indicates that a new address has been added to the association, then the entire INIT MUST be discarded, and NO changes should be made to the existing association. An ABORT SHOULD be sent in response that MAY include the error 'Restart of an association with new addresses'. The error SHOULD list the addresses that were added to the restarting association. 🚫 no sneaky new addresses allowed, bestie
When responding in either state (COOKIE-WAIT or COOKIE-ECHOED) with an INIT ACK, the original parameters are combined with those from the newly received INIT chunk. The endpoint shall also generate a State Cookie with the INIT ACK. The endpoint uses the parameters sent in its INIT to calculate the State Cookie. ✨
After that, the endpoint MUST NOT change its state, the T1-init timer shall be left running, and the corresponding TCB MUST NOT be destroyed. The normal procedures for handling State Cookies when a TCB exists will resolve the duplicate INITs to a single association. 🤝 everything merges back into one association, iconic
For an endpoint that is in the COOKIE-ECHOED state, it MUST populate its Tie-Tags within both the association TCB and inside the State Cookie (see Section 5.2.2 for a description of the Tie-Tags). 🏷️
5.2.2. Unexpected INIT in States Other than CLOSED, COOKIE-ECHOED, COOKIE-WAIT, and SHUTDOWN-ACK-SENT 💌
Okay so, unless something says otherwise, when an unexpected INIT shows up for this association, the endpoint shall generate an INIT ACK with a State Cookie. But wait, before it responds, it MUST check whether that unexpected INIT adds new addresses to the association 👀. If it does add new addresses, the endpoint MUST respond with an ABORT, and it has to copy the Initiate Tag from the unexpected INIT into the Verification Tag of the outbound packet carrying that ABORT. In the ABORT, the cause of error MAY be set to restart of an association with new addresses ✨. The error SHOULD list the addresses that got added to the restarting association 📝.
If no new addresses are added, then when the endpoint answers the INIT with its outbound INIT ACK, it MUST copy its current Tie-Tags into a reserved spot inside the State Cookie and into the association's TCB 🎀. We shall refer to those spots inside the cookie as the Peer's-Tie-Tag and the Local-Tie-Tag, and we will refer to the copy inside the TCB as the Local Tag and Peer's Tag 💜. The outbound SCTP packet carrying this INIT ACK MUST have a Verification Tag value equal to the Initiate Tag found in the unexpected INIT 🦋. The INIT ACK MUST also contain a new Initiate Tag, which is randomly generated (see Section 5.3.1) 🎲. Other parameters for the endpoint SHOULD be copied from the association's existing parameters (for example, the number of outbound streams) into the INIT ACK and the cookie 🌸.
Once the INIT ACK or ABORT is out the door, the endpoint shall take no further actions. Seriously, nothing else. The existing association, including its current state, and the corresponding TCB MUST NOT be changed 🙅♀️💅.
Note: Tie-Tags only get a value other than 0 when a TCB exists AND the association is not in the COOKIE-WAIT or SHUTDOWN-ACK-SENT state. For a normal association INIT (meaning the endpoint is in the CLOSED state), the Tie-Tags MUST be set to 0, which says "no previous TCB existed" 🫶.
5.2.3. Unexpected INIT ACK 🍓
If an INIT ACK lands on an endpoint in any state other than COOKIE-WAIT, the endpoint should discard the INIT ACK chunk. Usually, an unexpected INIT ACK means the endpoint is processing an old or duplicated INIT chunk 🕰️.
5.2.4. Handle a COOKIE ECHO when a TCB Exists 🍪
When a COOKIE ECHO chunk arrives at an endpoint in any state for an existing association (so, not CLOSED), the following rules shall be applied. Get ready, it's a whole process 💅:
- Compute a MAC as described in step 1 of Section 5.1.5.
- Authenticate the State Cookie as described in step 2 of Section 5.1.5 (this is case C or D above).
- Compare the timestamp in the State Cookie to the current time. If the State Cookie is older than the lifespan carried in the State Cookie AND the Verification Tags contained in the State Cookie do not match the current association's Verification Tags, the packet, including the COOKIE ECHO and any DATA chunks, should be discarded. The endpoint also MUST transmit an ERROR chunk with a
"Stale Cookie"error cause to the peer endpoint (this is case C or D in Section 5.2) 🚫.
If both Verification Tags in the State Cookie match the Verification Tags of the current association, consider the State Cookie valid (this is case E in Section 5.2), even if the lifespan has been exceeded ✅.
- If the State Cookie proves to be valid, unpack the TCB into a temporary TCB 📦.
- Refer to Table 2 to determine the correct action to be taken 🔍.
Here's Table 2, the big decision chart 💖:
+------------+------------+---------------+--------------+-------------+
| Local Tag | Peer's Tag | Local-Tie-Tag |Peer's-Tie-Tag| Action/ |
| | | | | Description |
+------------+------------+---------------+--------------+-------------+
| X | X | M | M | (A) |
+------------+------------+---------------+--------------+-------------+
| M | X | A | A | (B) |
+------------+------------+---------------+--------------+-------------+
| M | 0 | A | A | (B) |
+------------+------------+---------------+--------------+-------------+
| X | M | 0 | 0 | (C) |
+------------+------------+---------------+--------------+-------------+
| M | M | A | A | (D) |
+======================================================================+
| Table 2: Handling of a COOKIE ECHO when a TCB Exists |
+======================================================================+Legend, so you can read the chart 🗝️:
- X - Tag does not match the existing TCB.
- M - Tag matches the existing TCB.
- 0 - No Tie-Tag in cookie (unknown).
- A - All cases, i.e., M, X, or 0.
Note: For any case NOT shown in Table 2, the cookie should be silently discarded 🗑️.
Action
A) Okay, in this case the peer may have restarted 🔄. When the endpoint recognizes this potential 'restart', the existing session is treated the same as if it had received an ABORT followed by a new COOKIE ECHO, with these exceptions:
- Any SCTP DATA chunks MAY be retained (this is an implementation-specific option).
- A notification of RESTART SHOULD be sent to the ULP instead of a "COMMUNICATION LOST" notification.
All the congestion control parameters (for example, cwnd and ssthresh) related to this peer MUST be reset to their initial values (see Section 6.2.1) 🧹.
After all that, the endpoint shall enter the ESTABLISHED state 🥳.
If the endpoint is in the SHUTDOWN-ACK-SENT state and recognizes that the peer has restarted (Action A), it MUST NOT set up a new association. Instead, it MUST resend the SHUTDOWN ACK and send an ERROR chunk with a "Cookie Received While Shutting Down" error cause to its peer 🙅♀️.
B) In this case, both sides might be trying to start an association at about the same time, but the peer endpoint started its INIT after responding to the local endpoint's INIT 🤝. So it may have picked a new Verification Tag without knowing about the previous tag it had sent this endpoint 🤷♀️. The endpoint should stay in or enter the ESTABLISHED state, but it MUST update its peer's Verification Tag from the State Cookie, stop any init or cookie timers that may be running, and send a COOKIE ACK 🎀.
C) Here the local endpoint's cookie has arrived late ⏰. Before it showed up, the local endpoint sent an INIT, received an INIT ACK, and finally sent a COOKIE ECHO with the peer's same tag but a new tag of its own. The cookie should be silently discarded. The endpoint SHOULD NOT change states and should leave any timers running 🙈.
D) When both the local and remote tags match, the endpoint should enter the ESTABLISHED state, if it is in the COOKIE-ECHOED state 🎉. It should stop any cookie timer that may be running and send a COOKIE ACK 💖.
Note: The "peer's Verification Tag" is the tag received in the Initiate Tag field of the INIT or INIT ACK chunk 🧚.
5.2.4.1. An Example of a Association Restart 🎬
In this example, "A" starts the association after a restart has happened. Endpoint "Z" didn't know about the restart until this exchange (the Heartbeats hadn't caught A's failure yet). This assumes no bundling or fragmentation happens 🍿:
Endpoint A Endpoint Z
<-------------- Association is established---------------------->
Tag=Tag_A Tag=Tag_Z
<--------------------------------------------------------------->
{A crashes and restarts}
{app sets up a association with Z}
(build TCB)
INIT [I-Tag=Tag_A'
& other info] --------\
(Start T1-init timer) \
(Enter COOKIE-WAIT state) \---> (find an existing TCB
compose temp TCB and Cookie_Z
with Tie-Tags to previous
association)
/--- INIT ACK [Veri Tag=Tag_A',
/ I-Tag=Tag_Z',
(Cancel T1-init timer) <------/ Cookie_Z[TieTags=
Tag_A,Tag_Z
& other info]
(destroy temp TCB,leave original
in place)
COOKIE ECHO [Veri=Tag_Z',
Cookie_Z
Tie=Tag_A,
Tag_Z]----------\
(Start T1-init timer) \
(Enter COOKIE-ECHOED state) \---> (Find existing association,
Tie-Tags match old tags,
Tags do not match, i.e.,
case X X M M above,
Announce Restart to ULP
and reset association).
/---- COOKIE ACK
(Cancel T1-init timer, <------/
Enter ESTABLISHED state)
{app sends 1st user data; strm 0}
DATA [TSN=initial TSN_A
Strm=0,Seq=0 & user data]--\
(Start T3-rtx timer) \
\->
/--- SACK [TSN Ack=init TSN_A,Block=0]
(Cancel T3-rtx timer) <------/
Figure 5: A Restart Example5.2.5. Handle Duplicate COOKIE-ACK. 🍬
In any state other than COOKIE-ECHOED, an endpoint should silently discard a received COOKIE ACK chunk 🙊.
5.2.6. Handle Stale COOKIE Error 🥀
Getting an ERROR chunk with a "Stale Cookie" error cause means one of a few possible things happened 🤔:
A) The association failed to finish setting up before the State Cookie that the sender issued got processed.
B) An old State Cookie got processed after setup had already completed.
C) An old State Cookie came from someone the receiver isn't interested in associating with, and the ABORT chunk was lost.
When an endpoint processes an ERROR chunk with a "Stale Cookie" error cause, it should first check whether an association is in the middle of being set up, meaning it's in the COOKIE-ECHOED state 🔎. In every other case, where the association is not in the COOKIE-ECHOED state, the ERROR chunk should be silently discarded 🫥.
If the association IS in the COOKIE-ECHOED state, the endpoint may pick one of these three options 🎯:
- Send a new INIT chunk to the endpoint to generate a new State Cookie and try the setup procedure again.
- Discard the TCB and report to the upper layer that the association couldn't be set up.
- Send a new INIT chunk to the endpoint, adding a Cookie Preservative parameter that asks for an extension to the lifetime of the State Cookie. When calculating that extension, an implementation SHOULD use the RTT information measured from the previous COOKIE ECHO / ERROR exchange, and should add no more than 1 second beyond the measured RTT. The reason is that long State Cookie lifetimes make the endpoint more subject to a replay attack 🛡️⚠️.
5.3. Other Initialization Issues 🌈
5.3.1. Selection of Tag Value ✨
okay so, Initiate Tag values should be selected from the range of 1 to 2**32 - 1 💅 and it is SO important that the Initiate Tag gets randomized 🎲 because that's how you protect against "man in the middle" and "sequence number" attacks 😭 the methods in [RFC4086] can be used for the Initiate Tag randomization. Picking Initiate Tags carefully also matters, because you don't want old duplicate packets from previous associations getting mistakenly processed as part of the current association 🙈
And then, the Verification Tag value that either endpoint uses in a given association MUST NOT change for the whole life of that association 🔒 A new Verification Tag value MUST be used every single time an endpoint tears down and then re-establishes an association to the same peer 🌸
5.4. Path Verification 🦋
okay this one is giving detective energy 🕵️♀️ During association establishment, the two peers swap a list of addresses. Most of the time those lists are totally accurate and show the addresses each peer actually owns ✨ but a misbehaving peer might supply addresses it doesn't own, so to stop that, the following rules get applied to all addresses of the new association:
- Any address passed to the sender of the INIT by its upper layer is automatically considered to be CONFIRMED. 👑
- For the receiver of the COOKIE ECHO, the only CONFIRMED address is the one to which the INIT-ACK was sent. 💜
- All other addresses not covered by rules 1 and 2 are considered UNCONFIRMED and are subject to probing for verification. 🔍
To probe an address for verification, an endpoint sends HEARTBEATs that include a 64-bit random nonce and a path indicator (that's how it identifies the address the HEARTBEAT is sent to) inside the HEARTBEAT parameter 🧚
When the HEARTBEAT ACK comes back, the endpoint checks that the nonce in the HEARTBEAT parameter is the one that was sent to the address named inside that same parameter. When it matches ✨, the address the original HEARTBEAT went to is now CONFIRMED and good to go for normal data transfer 🎀
These probing procedures kick off when an association moves to the ESTABLISHED state, and they end once all paths are confirmed 🌈
In each RTO, a probe may be sent on an active UNCONFIRMED path to try to move it to the CONFIRMED state. If the path goes inactive during this probing, the rate drops to the normal HEARTBEAT rate 🥺 When the RTO timer expires, the error counter of any path that was probed but NOT CONFIRMED gets incremented by one and goes through path failure detection, as defined in Section 8.2 💀 but when you're probing UNCONFIRMED addresses, the association overall error count is NOT incremented, so no drama there 🫶
The number of HEARTBEATS sent at each RTO SHOULD be limited by the HB.Max.Burst parameter. How you spread HEARTBEATS across the peer's addresses for path verification is up to the implementation 🍓
Whenever a path gets confirmed, an indication MAY be given to the upper layer 🔔
An endpoint MUST NOT send any chunks to an UNCONFIRMED address, with a few exceptions, bestie 🚫
- A HEARTBEAT including a nonce MAY be sent to an UNCONFIRMED address. 💖
- A HEARTBEAT ACK MAY be sent to an UNCONFIRMED address. 💖
- A COOKIE ACK MAY be sent to an UNCONFIRMED address, but it MUST be bundled with a HEARTBEAT including a nonce. An implementation that does NOT support bundling MUST NOT send a COOKIE ACK to an UNCONFIRMED address. 🙅♀️
- A COOKIE ECHO MAY be sent to an UNCONFIRMED address, but it MUST be bundled with a HEARTBEAT including a nonce, and the packet MUST NOT exceed the path MTU. If the implementation does NOT support bundling, or if the bundled COOKIE ECHO plus HEARTBEAT (including nonce) would exceed the path MTU, then the implementation MUST NOT send a COOKIE ECHO to an UNCONFIRMED address. 🚧
6. User Data Transfer 💖
Data transmission MUST only happen in the ESTABLISHED, SHUTDOWN-PENDING, and SHUTDOWN-RECEIVED states 🌸 The only exception is that DATA chunks are allowed to be bundled with an outbound COOKIE ECHO chunk while in the COOKIE-WAIT state 🧁
DATA chunks MUST only be received according to the rules below in ESTABLISHED, SHUTDOWN-PENDING, and SHUTDOWN-SENT. A DATA chunk received in CLOSED is out of the blue and SHOULD be handled per Section 8.4. A DATA chunk received in any other state SHOULD be discarded 👀
A SACK MUST be processed in ESTABLISHED, SHUTDOWN-PENDING, and SHUTDOWN-RECEIVED. An incoming SACK MAY be processed in COOKIE-ECHOED. A SACK in the CLOSED state is out of the blue and SHOULD be processed according to the rules in Section 8.4. A SACK chunk received in any other state SHOULD be discarded 🫧
An SCTP receiver MUST be able to receive a minimum of 1500 bytes in one SCTP packet. That means an SCTP endpoint MUST NOT indicate less than 1500 bytes in its initial a_rwnd sent in the INIT or INIT ACK 📏
For transmission efficiency, SCTP has mechanisms for bundling small user messages and fragmenting large ones 🚀 The diagram below shows how user messages flow through SCTP 👇
In this section, the term "data sender" refers to the endpoint that transmits a DATA chunk, and the term "data receiver" refers to the endpoint that receives a DATA chunk. A data receiver will transmit SACK chunks 🌈
+--------------------------+
| User Messages |
+--------------------------+
SCTP user ^ |
==================|==|=======================================
| v (1)
+------------------+ +--------------------+
| SCTP DATA Chunks | |SCTP Control Chunks |
+------------------+ +--------------------+
^ | ^ |
| v (2) | v (2)
+--------------------------+
| SCTP packets |
+--------------------------+
SCTP ^ |
===========================|==|===========================
| v
Connectionless Packet Transfer Service (e.g., IP)Notes:
- When converting user messages into DATA chunks, an endpoint will fragment user messages larger than the current association path MTU into multiple DATA chunks. The data receiver will normally reassemble the fragmented message from DATA chunks before delivery to the user (see Section 6.9 for details). 🧩
- Multiple DATA and control chunks may be bundled by the sender into a single SCTP packet for transmission, as long as the final size of the packet does not exceed the current path MTU. The receiver will unbundle the packet back into the original chunks. Control chunks MUST come before DATA chunks in the packet. 📦
Figure 6: Illustration of User Data TransferThe fragmentation and bundling mechanisms, as detailed in Section 6.9 and Section 6.10, are OPTIONAL to implement by the data sender, but they MUST be implemented by the data receiver. That means an endpoint MUST properly receive and process bundled or fragmented data 🫶
6.1. Transmission of DATA Chunks ✨
okay so this doc is written as if there's one retransmission timer per destination transport address 🎀 but implementations MAY have a retransmission timer for each DATA chunk if they want more control 🦋
the data sender MUST apply the following general rules when transmitting and/or retransmitting outbound DATA chunks 💅
A) bestie, at any given time the data sender MUST NOT transmit new data to any destination transport address if its peer's rwnd says the peer has no buffer space (aka rwnd is 0, see Section 6.2.1) 😭 BUT even when rwnd is 0, the data sender can always have one DATA chunk in flight to the receiver, as long as cwnd allows it (see rule B, below) 🧚 this is the probe that lets the sender notice when rwnd changes, which it might have missed because the SACKs got lost on the way from the receiver back to the sender 🫶
when the receiver's advertised window is zero, this probe is called a zero window probe 🌸 a zero window probe SHOULD only be sent once all outstanding DATA chunks have been cumulatively acknowledged and no DATA chunks are in flight 🙈 zero window probing MUST be supported 👑
if the sender keeps getting new packets from the receiver while it's doing zero window probing, the unacknowledged window probes should not increment the error counter for the association or any destination transport address 💜 the receiver MAY keep its window closed for an indefinite time, so this makes sense 🌈 check out Section 6.2 for what the receiver does when it advertises a zero window ✨ the sender SHOULD send the first zero window probe after 1 RTO once it detects that the receiver has closed its window, and SHOULD increase the probe interval exponentially after that 🔥 also, the cwnd SHOULD be adjusted according to Section 7.2.1 💅 zero window probing doesn't affect how cwnd is calculated, periodt 💀
the sender MUST also have an algorithm for sending new DATA chunks that avoids silly window syndrome (SWS) as described in [RFC0813] 🍓 the algorithm can be similar to the one described in Section 4.2.3.4 of [RFC1122] 🎀
however, even when rwnd is 0, the data sender can always have one DATA chunk in flight to the receiver if cwnd allows it (see rule B below) 🦋 this is the same probe as before, the one that lets the sender find a change in rwnd it missed because the SACK got lost in transit from the data receiver to the data sender 💖
B) at any given time, the sender MUST NOT transmit new data to a given transport address if it already has cwnd or more bytes of data outstanding to that transport address 🙅♀️💅
C) when it's time for the sender to transmit, before sending new DATA chunks, the sender MUST first transmit any outstanding DATA chunks that are marked for retransmission (limited by the current cwnd) 🧚♀️✨
D) when it's time for the sender to transmit new DATA chunks, the protocol parameter Max.Burst SHOULD be used to limit the number of packets sent 🌸 the limit MAY be applied by adjusting cwnd like this:
if((flightsize + Max.Burst*MTU) < cwnd) cwnd = flightsize +
Max.Burst*MTUor it MAY be applied by strictly limiting the number of packets emitted by the output routine 🫶
E) then the sender can send out as many new DATA chunks as rule A and rule B allow 👑
multiple DATA chunks committed for transmission MAY be bundled in a single packet 🎀 furthermore, DATA chunks being retransmitted MAY be bundled with new DATA chunks, as long as the resulting packet size does not exceed the path MTU 🦋 a ULP may request that no bundling is performed, but this should only turn off any delays that an SCTP implementation may be using to increase bundling efficiency 🌈 it does not, by itself, stop all bundling from happening (i.e., in case of congestion or retransmission) 💜
before an endpoint transmits a DATA chunk, if any received DATA chunks haven't been acknowledged yet (e.g., because of a delayed ack), the sender should create a SACK and bundle it with the outbound DATA chunk, as long as the size of the final SCTP packet doesn't exceed the current MTU 🍓 see Section 6.2 🧚
IMPLEMENTATION NOTE: when the window is full (i.e., transmission is disallowed by rule A and/or rule B), the sender MAY still accept send requests from its upper layer, but MUST transmit no more DATA chunks until some or all of the outstanding DATA chunks are acknowledged and transmission is allowed by rule A and rule B again 😭🔥
whenever a transmission or retransmission goes to any address, if the T3-rtx timer of that address isn't currently running, the sender MUST start that timer 💖 if the timer for that address is already running, the sender MUST restart the timer if the earliest (i.e., lowest TSN) outstanding DATA chunk sent to that address is being retransmitted 🌸 otherwise, the data sender MUST NOT restart the timer 🙈
when starting or restarting the T3-rtx timer, the timer value must be adjusted according to the timer rules defined in Sections 6.3.2 and 6.3.3 ✨
Note: the data sender SHOULD NOT use a TSN that is more than 2**31 - 1 above the beginning TSN of the current send window 🔥💅
6.2. Acknowledgement on Reception of DATA Chunks ✨
Okay bestie, the receiving side has some big responsibilities 💅 Every SCTP endpoint MUST always acknowledge each valid DATA chunk it receives, as long as that chunk lands inside its receive window 💖
When the receiver's advertised window is 0, things get intense 😭 The receiver MUST drop any new incoming DATA chunk whose TSN is larger than the largest TSN received so far. If the new chunk has a TSN smaller than the largest TSN received so far, the receiver SHOULD drop the largest TSN it's holding for reordering and accept the new chunk instead 🔥 Either way, if a chunk gets dropped, the receiver MUST immediately send back a SACK. That SACK shows the current receive window and only the DATA chunks received and accepted so far. The dropped chunks MUST NOT appear in the SACK, because they were never accepted 🙈 The receiver MUST also have an algorithm for advertising its receive window so it avoids receiver silly window syndrome (SWS), as described in [RFC0813]. That algorithm can look a lot like the one in Section 4.2.3.3 of [RFC1122] 🌸
The guidelines on the delayed acknowledgement algorithm in Section 4.2 of [RFC2581] SHOULD be followed 🦋 Specifically, an acknowledgement SHOULD be generated for at least every second packet (not every second DATA chunk) received, and SHOULD be generated within 200 ms of the arrival of any unacknowledged DATA chunk. Sometimes it's smart for an SCTP transmitter to be more conservative than what this document allows, ngl 🧚 But an SCTP transmitter MUST NOT be more aggressive than the algorithms below allow 👑
An SCTP receiver MUST NOT generate more than one SACK for every incoming packet. The only exception is updating the offered window as the receiving application consumes new data ✨
IMPLEMENTATION NOTE: The maximum delay for generating an acknowledgement may be configured by the SCTP administrator, either statically or dynamically, in order to meet the specific timing requirement of the protocol being carried.
An implementation MUST NOT let the maximum delay be configured to more than 500 ms. In other words, an implementation MAY lower this value below 500 ms, but it MUST NOT raise it above 500 ms 💀
Acknowledgements MUST be sent in SACK chunks, unless the ULP requested shutdown. In that case, an endpoint MAY send an acknowledgement in the SHUTDOWN chunk 🎀 A single SACK chunk can acknowledge multiple DATA chunks at once. Check Section 3.3.4 for the SACK chunk format 🍓 The SCTP endpoint MUST fill in the Cumulative TSN Ack field with the latest sequential TSN (of a valid DATA chunk) it has received. Any received DATA chunks with a TSN greater than the value in Cumulative TSN Ack get reported in the Gap Ack Block fields. The SCTP endpoint MUST report as many Gap Ack Blocks as can fit in a single SACK chunk, limited by the current path MTU 🌈
Note: The SHUTDOWN chunk does not contain Gap Ack Block fields. Therefore, the endpoint should use a SACK instead of the SHUTDOWN chunk to acknowledge DATA chunks received out of order.
When a packet arrives with duplicate DATA chunk(s) and no new DATA chunk(s), the endpoint MUST immediately send a SACK with no delay 🚨 If a packet arrives with duplicate DATA chunk(s) bundled together with new DATA chunks, the endpoint MAY immediately send a SACK. Usually, duplicates show up when the original SACK got lost and the peer's RTO has expired 😩 The duplicate TSN number(s) SHOULD be reported in the SACK as duplicate 🫶
When an endpoint receives a SACK, it MAY use the duplicate TSN information to figure out whether SACK loss is happening. Further use of this data is for future study 🔮
The data receiver is responsible for maintaining its receive buffers, and it SHOULD tell the data sender in a timely manner whenever its ability to receive data changes 🫧 How an implementation manages those buffers depends on lots of factors, like the operating system, the memory management system, the amount of memory, and so on. Still, the data sender strategy in Section 6.2.1 assumes the receiver behaves roughly like this:
- A) At initialization of the association, the endpoint tells its peer how much receive buffer space it has allocated to the association, using the INIT or INIT ACK. The endpoint sets
a_rwndto this value. - B) As DATA chunks are received and buffered, the endpoint decrements
a_rwndby the number of bytes received and buffered. Basically, this closesrwndat the data sender and limits how much it can transmit 🌸 - C) As DATA chunks are delivered to the ULP and released from the receive buffers, the endpoint increments
a_rwndby the number of bytes delivered to the upper layer. Basically, this opens uprwndon the data sender so it can send more 🦋 The data receiver SHOULD NOT incrementa_rwndunless it has actually released bytes from its receive buffer. For example, if the receiver is holding fragmented DATA chunks in a reassembly queue, it should not incrementa_rwnd. - D) When sending a SACK, the data receiver SHOULD place the current value of
a_rwndinto thea_rwndfield. It SHOULD also account for the fact that the data sender will not retransmit DATA chunks acked throughCumulative TSN Ack(meaning they get dropped from its retransmit queue) 💜
Under certain circumstances, the data receiver may need to drop DATA chunks it has received but not yet released from its receive buffers (meaning not yet delivered to the ULP). These chunks may already have been acked in Gap Ack Blocks. For example, the data receiver might be holding data while it reassembles a fragmented user message from its peer, then run out of receive buffer space 😱 It may drop those chunks even though it already acknowledged them in Gap Ack Blocks. If a data receiver drops DATA chunks, it MUST NOT include them in Gap Ack Blocks in subsequent SACKs until they're received again via retransmission. The endpoint should also take the dropped data into account when calculating its a_rwnd ✨
An endpoint SHOULD NOT revoke a SACK and discard data 🙅♀️ Only in extreme circumstances (like running out of buffer space) should an endpoint use this procedure. The data receiver should keep in mind that dropping data already acked in Gap Ack Blocks can lead to suboptimal retransmission strategies in the data sender, and that means suboptimal performance too 😬
Here's the delayed acknowledgement example, bestie 🎀 Watch how the ACKs get delayed and bundled:
Endpoint A Endpoint Z
{App sends 3 messages; strm 0}
DATA [TSN=7,Strm=0,Seq=3] ------------> (ack delayed)
(Start T3-rtx timer)
DATA [TSN=8,Strm=0,Seq=4] ------------> (send ack)
/------- SACK [TSN Ack=8,block=0]
(cancel T3-rtx timer) <-----/
DATA [TSN=9,Strm=0,Seq=5] ------------> (ack delayed)
(Start T3-rtx timer)
...
{App sends 1 message; strm 1}
(bundle SACK with DATA)
/----- SACK [TSN Ack=9,block=0] \
/ DATA [TSN=6,Strm=1,Seq=2]
(cancel T3-rtx timer) <------/ (Start T3-rtx timer)
(ack delayed)
(send ack)
SACK [TSN Ack=6,block=0] -------------> (cancel T3-rtx timer)
Figure 7: Delayed Acknowledgement ExampleIf an endpoint receives a DATA chunk with no user data (meaning the Length field is set to 16), it MUST send an ABORT with the error cause set to "No User Data" 🚫 An endpoint SHOULD NOT send a DATA chunk with no user data part either 🫶
6.2.1. Processing a Received SACK
Every SACK an endpoint receives carries an a_rwnd value 🎀 That value tells you how much buffer space the data receiver had left, at the moment it sent the SACK, out of its total receive buffer space (the amount specified in the INIT/INIT ACK). Using a_rwnd, Cumulative TSN Ack, and the Gap Ack Blocks, the data sender can build a picture of the peer's receive buffer space 🧠
One problem the data sender has to handle is that SACKs can arrive out of order 🌀 A SACK sent later by the data receiver can overtake an earlier one and show up first. If that happens, the data sender can end up with a wrong view of the peer's receive buffer space 😵
Since there's no explicit identifier that can tell out-of-order SACKs apart, the data sender has to use heuristics to figure out whether a SACK is new 🕵️♀️
An endpoint SHOULD use the following rules to calculate rwnd, using the a_rwnd value, the Cumulative TSN Ack, and the Gap Ack Blocks in a received SACK 💖
- A) When the association is established, the endpoint initializes
rwndto the Advertised Receiver Window Credit (a_rwnd) that the peer specified in the INIT or INIT ACK. - B) Any time a DATA chunk is transmitted (or retransmitted) to a peer, the endpoint subtracts the data size of the chunk from that peer's
rwnd. - C) Any time a DATA chunk is marked for retransmission, whether through T3-rtx timer expiration (Section 6.3.3) or through Fast Retransmit (Section 7.2.4), the endpoint adds the data size of those chunks back to
rwnd🦋
Note: If the implementation maintains a timer on each DATA chunk, then only the DATA chunks whose timer expired would be marked for retransmission.
- D) Any time a SACK arrives, the endpoint does the following 🔥
- i) If
Cumulative TSN Ackis less than theCumulative TSN Ack Point, drop the SACK. SinceCumulative TSN Ackonly ever increases, a SACK whoseCumulative TSN Ackis less than theCumulative TSN Ack Pointis an out-of-order SACK 🙃 - ii) Set
rwndequal to the newly receiveda_rwndminus the number of bytes still outstanding after processing theCumulative TSN Ackand the Gap Ack Blocks 🌸 - iii) If the SACK is missing a TSN that was previously acknowledged in a Gap Ack Block (for example, the data receiver reneged on the data), then treat the corresponding DATA as possibly missing. Count one miss indication toward Fast Retransmit as described in Section 7.2.4. If no retransmit timer is running for the destination address the DATA chunk was originally sent to, then T3-rtx is started for that destination address ⏰
- iv) If
Cumulative TSN Ackmatches or exceeds the Fast Recovery exitpoint (Section 7.2.4), Fast Recovery is exited 🎉
- i) If
6.3. Management of Retransmission Timer 🌈
An SCTP endpoint uses a retransmission timer, T3-rtx, to make sure data gets delivered even when its peer gives no feedback at all 🫶 The length of this timer is called the RTO (retransmission timeout).
If an endpoint's peer is multi-homed, the endpoint calculates a separate RTO for each different destination transport address its peer has 🧚
The way SCTP computes and manages RTO follows TCP's approach really closely 💅 To work out the current RTO, an endpoint keeps two state variables per destination transport address: SRTT (smoothed round-trip time) and RTTVAR (round-trip time variation) 🍓
6.3.1. RTO Calculation ✨
Okay bestie, let's talk about how the RTO gets calculated, because this part is giving math but make it iconic 💅 The rules for SRTT, RTTVAR, and RTO go like this:
C1) Until an RTT measurement has been made for a packet sent to the given destination transport address, set RTO to the protocol parameter 'RTO.Initial'. 🌸
C2) When the first RTT measurement R is made, set:
SRTT <- R,
RTTVAR <- R/2, and
RTO <- SRTT + 4 * RTTVAR.C3) When a new RTT measurement R' is made, set:
RTTVAR <- (1 - RTO.Beta) * RTTVAR + RTO.Beta * |SRTT - R'|
and
SRTT <- (1 - RTO.Alpha) * SRTT + RTO.Alpha * R'Note: the SRTT used in the RTTVAR update is the value from before SRTT gets updated by the second assignment, so no mixing up the order, okay? 🙈 After all that, update RTO <- SRTT + 4 * RTTVAR. 🎀
C4) When data is in flight and when allowed by rule C5 below, a new RTT measurement MUST be made each round trip. 💖 Furthermore, new RTT measurements SHOULD be made no more than once per round trip for a given destination transport address. There are two reasons for this. First, measuring more frequently often doesn't seem to give any significant benefit in practice [ALLMAN99] 🦋 Second, if you do measure more often, then RTO.Alpha and RTO.Beta in rule C3 above should be adjusted so SRTT and RTTVAR still change at roughly the same rate (counted in how many round trips it takes them to reflect new values) as they would with one measurement per round trip using RTO.Alpha and RTO.Beta as given in rule C3. Honestly though, the exact nature of those adjustments is still a research issue 🧐
C5) Karn's algorithm: RTT measurements MUST NOT be made using packets that were retransmitted, because then it's ambiguous whether the reply was for the first instance of the chunk or a later one. 💀
IMPLEMENTATION NOTE: RTT measurements should only be made using a chunk with TSN r if no chunk with TSN less than or equal to r is retransmitted since r is first sent.
C6) Whenever RTO is computed, if it is less than RTO.Min seconds, then it gets rounded up to RTO.Min seconds. The reason is that RTOs without a high minimum value are susceptible to unnecessary timeouts [ALLMAN99]. 🫶
C7) A maximum value may be placed on RTO, provided it is at least RTO.max seconds. 👑
There is no requirement for the clock granularity G used for computing RTT measurements and the different state variables, other than:
G1) Whenever RTTVAR is computed, if RTTVAR = 0, then adjust RTTVAR <- G. 🍓
Experience [ALLMAN99] has shown that finer clock granularities (<= 100 msec) perform somewhat better than more coarse granularities. ✨
6.3.2. Retransmission Timer Rules 🧚
The rules for managing the retransmission timer are as follows:
R1) Every time a DATA chunk is sent to any address (including a retransmission), if the T3-rtx timer of that address is not running, start it running so that it will expire after the RTO of that address. The RTO used here is the one obtained after any doubling due to previous T3-rtx timer expirations on the corresponding destination address, as discussed in rule E2 below. 🌈
R2) Whenever all outstanding data sent to an address has been acknowledged, turn off the T3-rtx timer of that address. 🫧
R3) Whenever a SACK is received that acknowledges the DATA chunk with the earliest outstanding TSN for that address, restart the T3-rtx timer for that address with its current RTO (if there is still outstanding data on that address). 🔥
R4) Whenever a SACK is received missing a TSN that was previously acknowledged via a Gap Ack Block, start the T3-rtx for the destination address to which the DATA chunk was originally transmitted, if it is not already running. 💜
The following example shows the use of the various timer rules (assuming that the receiver uses delayed acks). It's a whole vibe, bestie 🦋
Endpoint A Endpoint Z
{App begins to send}
Data [TSN=7,Strm=0,Seq=3] ------------> (ack delayed)
(Start T3-rtx timer)
{App sends 1 message; strm 1}
(bundle ack with data)
DATA [TSN=8,Strm=0,Seq=4] ----\ /-- SACK [TSN Ack=7,Block=0]
\ / DATA [TSN=6,Strm=1,Seq=2]
\ / (Start T3-rtx timer)
\
/ \
(Restart T3-rtx timer) <------/ \--> (ack delayed)
(ack delayed)
{send ack}
SACK [TSN Ack=6,Block=0] --------------> (Cancel T3-rtx timer)
..
(send ack)
(Cancel T3-rtx timer) <-------------- SACK [TSN Ack=8,Block=0]
Figure 8: Timer Rule Examples6.3.3. Handle T3-rtx Expiration 💅
Whenever the retransmission timer T3-rtx expires for a destination address, do the following:
E1) For the destination address for which the timer expires, adjust its ssthresh with the rules defined in Section 7.2.3 and set the cwnd <- MTU. 🎀
E2) For the destination address for which the timer expires, set RTO <- RTO * 2 ("back off the timer"). The maximum value discussed in rule C7 above (RTO.max) may be used to provide an upper bound to this doubling operation. 🌸
E3) Determine how many of the earliest (i.e., lowest TSN) outstanding DATA chunks for the address for which the T3-rtx has expired will fit into a single packet, subject to the MTU constraint for the path corresponding to the destination transport address to which the retransmission is being sent. (This may be different from the address for which the timer expires; see Section 6.4.) Call this value K. Bundle and retransmit those K DATA chunks in a single packet to the destination endpoint. 📦
E4) Start the retransmission timer T3-rtx on the destination address to which the retransmission is sent, if rule R1 above indicates to do so. The RTO to be used for starting T3-rtx should be the one for the destination address to which the retransmission is sent. When the receiver is multi-homed, this may be different from the destination address for which the timer expired (see Section 6.4 below). 🦄
After retransmitting, once a new RTT measurement is obtained (which can happen only when new data has been sent and acknowledged, per rule C5, or for a measurement made from a HEARTBEAT; see Section 8.3), the computation in rule C3 is performed. That includes the computation of RTO, which may result in "collapsing" RTO back down after it has been subject to doubling (rule E2). 🔄
Note: Any DATA chunks that were sent to the address for which the T3-rtx timer expired but did not fit in one MTU (rule E3 above) should be marked for retransmission and sent as soon as cwnd allows (normally, when a SACK arrives). 📝
The final rule for managing the retransmission timer concerns failover (see Section 6.4.1):
F1) Whenever an endpoint switches from the current destination transport address to a different one, the current retransmission timers are left running. As soon as the endpoint transmits a packet containing DATA chunk(s) to the new transport address, start the timer on that transport address, using the RTO value of the destination address to which the data is being sent, if rule R1 indicates to do so. 🚀
6.4. Multi-Homed SCTP Endpoints 🏠
An SCTP endpoint is considered multi-homed if there is more than one transport address that can be used as a destination address to reach that endpoint. 🌐
Moreover, the ULP of an endpoint shall select one of the multiple destination addresses of a multi-homed peer endpoint as the primary path (see Section 5.1.2 and Section 10.1 for details). 👑
By default, an endpoint SHOULD always transmit to the primary path, unless the SCTP user explicitly specifies the destination transport address (and possibly source transport address) to use. 💖
An endpoint SHOULD transmit reply chunks (e.g., SACK, HEARTBEAT ACK, etc.) to the same destination transport address from which it received the DATA or control chunk to which it is replying. This rule should also be followed if the endpoint is bundling DATA chunks together with the reply chunk. 🫶
However, when acknowledging multiple DATA chunks received in packets from different source addresses in a single SACK, the SACK chunk may be transmitted to one of the destination transport addresses from which the DATA or control chunks being acknowledged were received. 🦋
When a receiver of a duplicate DATA chunk sends a SACK to a multi-homed endpoint, it MAY be beneficial to vary the destination address and not use the source address of the DATA chunk. The reason is that receiving a duplicate from a multi-homed endpoint might indicate that the return path (as specified in the source address of the DATA chunk) for the SACK is broken. 🙈
Furthermore, when its peer is multi-homed, an endpoint SHOULD try to retransmit a chunk that timed out to an active destination transport address that is different from the last destination address to which the DATA chunk was sent. 🧚
Retransmissions do not affect the total outstanding data count. However, if the DATA chunk is retransmitted onto a different destination address, both the outstanding data counts on the new destination address and the old destination address to which the data chunk was last sent shall be adjusted accordingly. 🔢
6.4.1. Failover from an Inactive Destination Address 🌷
Some of the transport addresses of a multi-homed SCTP endpoint may become inactive due to either the occurrence of certain error conditions (see Section 8.2) or adjustments from the SCTP user. 😬
When there is outbound data to send and the primary path becomes inactive (e.g., due to failures), or where the SCTP user explicitly requests to send data to an inactive destination transport address, the SCTP endpoint should try to send the data to an alternate active destination transport address, if one exists, before reporting an error to its ULP. 🛟
When retransmitting data that timed out, if the endpoint is multi-homed, it should consider each source-destination address pair in its retransmission selection policy. When retransmitting timed-out data, the endpoint should attempt to pick the most divergent source-destination pair from the original source-destination pair to which the packet was transmitted. 🧭
Note: Rules for picking the most divergent source-destination pair are an implementation decision and are not specified within this document. 🌟
6.5. Stream Identifier and Stream Sequence Number ✨
Okay so every DATA chunk MUST carry a valid stream identifier, no exceptions 🫶. If an endpoint gets a DATA chunk with an invalid stream identifier, it shall acknowledge the DATA chunk following the normal procedure, immediately send an ERROR chunk with cause set to "Invalid Stream Identifier" (see Section 3.3.10), and discard the DATA chunk. It may bundle that ERROR chunk in the same packet as the SACK, as long as the ERROR follows the SACK 💅.
The Stream Sequence Number in all the streams MUST start from 0 when the association is established. Also, when the Stream Sequence Number reaches the value 65535, the next Stream Sequence Number MUST be set to 0 🌸.
6.6. Ordered and Unordered Delivery 🦋
Within a stream, an endpoint MUST deliver DATA chunks received with the U flag set to 0 to the upper layer according to the order of their Stream Sequence Number. If DATA chunks arrive out of order of their Stream Sequence Number, the endpoint MUST hold the received DATA chunks from delivery to the ULP until they are reordered. Hold them until they're in order, no drama 💜.
However, an SCTP endpoint can indicate that no ordered delivery is required for a particular DATA chunk sent within the stream by setting the U flag of that DATA chunk to 1.
When an endpoint receives a DATA chunk with the U flag set to 1, it must bypass the ordering mechanism and immediately deliver the data to the upper layer (after reassembly if the user data is fragmented by the data sender). That's the fast lane, bestie 🏎️✨.
This is an effective way to send "out-of-band" data in a given stream. Also, a stream can be used as an "unordered" stream by simply setting the U flag to 1 in all DATA chunks sent through that stream 🌈.
IMPLEMENTATION NOTE: When sending an unordered DATA chunk, an implementation may choose to place the DATA chunk in an outbound packet that is at the head of the outbound transmission queue if possible.
The Stream Sequence Number field in a DATA chunk with U flag set to 1 has no significance. The sender can fill it with an arbitrary value, but the receiver MUST ignore the field. It's literally just there and nobody reads it 🙈.
Note: When transmitting ordered and unordered data, an endpoint does not increment its Stream Sequence Number when transmitting a DATA chunk with U flag set to 1.
6.7. Report Gaps in Received DATA TSNs 🕵️♀️
Upon the reception of a new DATA chunk, an endpoint shall examine the continuity of the TSNs received. If the endpoint detects a gap in the received DATA chunk sequence, it SHOULD send a SACK with Gap Ack Blocks immediately. The data receiver keeps sending a SACK after receipt of each SCTP packet that doesn't fill the gap 👀.
Based on the Gap Ack Block from the received SACK, the endpoint can calculate the missing DATA chunks and make decisions on whether to retransmit them (see Section 6.2.1 for details).
Multiple gaps can be reported in one single SACK (see Section 3.3.4). Tea. ☕
When its peer is multi-homed, the SCTP endpoint SHOULD always try to send the SACK to the same destination address from which the last DATA chunk was received 📍.
Upon the reception of a SACK, the endpoint MUST remove all DATA chunks that have been acknowledged by the SACK's Cumulative TSN Ack from its transmit queue. The endpoint MUST also treat all the DATA chunks with TSNs not included in the Gap Ack Blocks reported by the SACK as "missing". The number of "missing" reports for each outstanding DATA chunk MUST be recorded by the data sender in order to make retransmission decisions. See Section 7.2.4 for details.
Here's an example of a SACK reporting a gap, and it's giving main character 🎬:
Endpoint A Endpoint Z {App
sends 3 messages; strm 0} DATA [TSN=6,Strm=0,Seq=2] ----------
-----> (ack delayed) (Start T3-rtx timer)
DATA [TSN=7,Strm=0,Seq=3] --------> X (lost)
DATA [TSN=8,Strm=0,Seq=4] ---------------> (gap detected,
immediately send ack)
/----- SACK [TSN Ack=6,Block=1,
/ Start=2,End=2]
<-----/ (remove 6 from out-queue,
and mark 7 as "1" missing report)
Figure 9: Reporting a Gap using SACKThe maximum number of Gap Ack Blocks that can be reported within a single SACK chunk is limited by the current path MTU. When a single SACK cannot cover all the Gap Ack Blocks needed to be reported due to the MTU limitation, the endpoint MUST send only one SACK. That SACK reports the Gap Ack Blocks from the lowest to highest TSNs, within the size limit set by the MTU, and leaves the remaining highest TSN numbers unacknowledged. Save the rest for next time 🫠.
6.8. CRC32c Checksum Calculation 🔐
When sending an SCTP packet, the endpoint MUST strengthen the data integrity of the transmission by including the CRC32c checksum value calculated on the packet, as described below.
After the packet is constructed (containing the SCTP common header and one or more control or DATA chunks), the transmitter MUST:
- fill in the proper Verification Tag in the SCTP common header and initialize the checksum field to
'0's, - calculate the CRC32c checksum of the whole packet, including the SCTP common header and all the chunks (refer to Appendix B for details of the CRC32c algorithm); and
- put the resultant value into the checksum field in the common header, and leave the rest of the bits unchanged.
When an SCTP packet is received, the receiver MUST first check the CRC32c checksum as follows:
- Store the received CRC32c checksum value aside.
- Replace the 32 bits of the checksum field in the received SCTP packet with all
'0'sand calculate a CRC32c checksum value of the whole received packet. - Verify that the calculated CRC32c checksum is the same as the received CRC32c checksum. If it is not, the receiver MUST treat the packet as an invalid SCTP packet.
The default procedure for handling invalid SCTP packets is to silently discard them. Bye, invalid packets 👋.
Any hardware implementation SHOULD be done in a way that is verifiable by the software. Trust, but verify 🫡.
6.9. Fragmentation and Reassembly 🧩
An endpoint MAY support fragmentation when sending DATA chunks, but it MUST support reassembly when receiving DATA chunks. If an endpoint supports fragmentation, it MUST fragment a user message if the size of the user message to be sent causes the outbound SCTP packet size to exceed the current MTU. If an implementation does not support fragmentation of outbound user messages, the endpoint MUST return an error to its upper layer and not attempt to send the user message. Don't even try, bestie 🙅♀️.
Note: If an implementation that supports fragmentation makes available to its upper layer a mechanism to turn off fragmentation, it may do so. However, in so doing, it MUST react just like an implementation that does NOT support fragmentation, i.e., it MUST reject sends that exceed the current Path MTU (P-MTU).
IMPLEMENTATION NOTE: In this error case, the Send primitive discussed in Section 10.1 would need to return an error to the upper layer.
If its peer is multi-homed, the endpoint shall choose a size no larger than the association Path MTU. The association Path MTU is the smallest Path MTU of all destination addresses.
Note: Once a message is fragmented, it cannot be re-fragmented. Instead, if the PMTU has been reduced, then IP fragmentation must be used. Please see Section 7.3 for details of PMTU discovery.
When determining when to fragment, the SCTP implementation MUST take into account the SCTP packet header as well as the DATA chunk header(s). The implementation MUST also take into account the space required for a SACK chunk if bundling a SACK chunk with the DATA chunk. Pack your bags, headers, the SACK is coming too 🧳.
Fragmentation takes the following steps:
- The data sender MUST break the user message into a series of DATA chunks such that each chunk plus SCTP overhead fits into an IP datagram smaller than or equal to the association Path MTU.
- The transmitter MUST then assign, in sequence, a separate TSN to each of the DATA chunks in the series. The transmitter assigns the same SSN to each of the DATA chunks. If the user indicates that the user message is to be delivered using unordered delivery, then the U flag of each DATA chunk of the user message MUST be set to 1.
- The transmitter MUST also set the B/E bits of the first DATA chunk in the series to
'10', the B/E bits of the last DATA chunk in the series to'01', and the B/E bits of all other DATA chunks in the series to'00'.
An endpoint MUST recognize fragmented DATA chunks by examining the B/E bits in each of the received DATA chunks, and queue the fragmented DATA chunks for reassembly. Once the user message is reassembled, SCTP shall pass the reassembled user message to the specific stream for possible reordering and final dispatching. Reassembly complete, we're so back 🌈.
Note: If the data receiver runs out of buffer space while still waiting for more fragments to complete the reassembly of the message, it should dispatch part of its inbound message through a partial delivery API (see Section 10), freeing some of its receive buffer space so that the rest of the message may be received.
6.10. Bundling 📦
An endpoint bundles chunks by simply including multiple chunks in one outbound SCTP packet. The total size of the resultant IP datagram, including the SCTP packet and IP headers, MUST be less than or equal to the current Path MTU.
If its peer endpoint is multi-homed, the sending endpoint shall choose a size no larger than the latest MTU of the current primary path.
When bundling control chunks with DATA chunks, an endpoint MUST place control chunks first in the outbound SCTP packet. The transmitter MUST transmit DATA chunks within an SCTP packet in increasing order of TSN. Control chunks go first, always, that's just the vibe 🎀.
Note: Since control chunks must be placed first in a packet and since DATA chunks must be transmitted before SHUTDOWN or SHUTDOWN ACK chunks, DATA chunks cannot be bundled with SHUTDOWN or SHUTDOWN ACK chunks.
Partial chunks MUST NOT be placed in an SCTP packet. A partial chunk is a chunk that is not completely contained in the SCTP packet; i.e., the SCTP packet is too short to contain all the bytes of the chunk as indicated by the chunk length. Half-a-chunk is not it, bestie 💀.
An endpoint MUST process received chunks in their order in the packet. The receiver uses the Chunk Length field to determine the end of a chunk and beginning of the next chunk, taking account of the fact that all chunks end on a 4-byte boundary. If the receiver detects a partial chunk, it MUST drop the chunk.
An endpoint MUST NOT bundle INIT, INIT ACK, or SHUTDOWN COMPLETE with any other chunks. These three are giving main character, solo act 💖.
7. Congestion Control ✨
okay bestie, congestion control is one of the basic functions in SCTP 💖. for some apps, enough resources might get allocated to SCTP traffic so time-critical data arrives on time, so during normal operations it seems pretty unlikely that transmissions run into severe congestion 🦋. but SCTP has to keep working in rough conditions too, like partial network failures or sudden traffic surges 💀. when that happens, SCTP must follow correct congestion control steps to recover from congestion quickly so data gets delivered asap 🔥. and when there's no network congestion, these preventive algorithms should show no impact on protocol performance ✨.
IMPLEMENTATION NOTE: as long as its specific performance requirements are met, an implementation is always allowed to pick a more conservative congestion control algorithm than the one defined below 🫶.
the congestion control algorithms SCTP uses are based on [RFC2581] 🌸. this section explains how the algorithms in [RFC2581] get adapted for SCTP. first we list the protocol design differences between TCP and SCTP, then we walk through SCTP's congestion control scheme 💅. we'll use TCP congestion control terminology wherever it fits ✨.
SCTP congestion control is always applied to the entire association, never to individual streams 🎀.
7.1. SCTP Differences from TCP Congestion Control
Gap Ack Blocks in the SCTP SACK carry the same semantic meaning as the TCP SACK 🧚. TCP treats the information in the SACK as advisory only. SCTP also treats the information in the Gap Ack Blocks in the SACK chunk as advisory 🦋. in SCTP, any DATA chunk acknowledged by SACK, including DATA that arrived out of order, is not considered fully delivered until the Cumulative TSN Ack Point passes its TSN. in other words, the DATA chunk has to be acknowledged by the Cumulative TSN Ack field in the SACK 😭. because of this, the value of cwnd controls the amount of outstanding data. in non-SACK TCP, it instead controls the upper bound between the highest acknowledged sequence number and the latest DATA chunk that can be sent within the congestion window 💜. SCTP SACK also leads to different implementations of Fast Retransmit and Fast Recovery than non-SACK TCP. for an example, check out [FALL96] 🔥.
the biggest difference between SCTP and TCP, though, is multi-homing 👑. SCTP is designed to set up robust communication associations between two endpoints, and each endpoint may be reachable by more than one transport address 🌈. different addresses can lead to different data paths between the two endpoints, so ideally you'd want a separate set of congestion control parameters for each path 🙈. the way this document handles congestion control for multi-homed receivers is new with SCTP, and it may need refining later ⭐. the current algorithms make the following assumptions:
- The sender usually uses the same destination address until the upper layer tells it to do otherwise. however, SCTP may change to an alternate destination when an address is marked inactive (see Section 8.2). also, SCTP may retransmit to a different transport address than the original transmission 🍓.
- The sender keeps a separate congestion control parameter set for each destination address it can send to. this is per destination, not per source-destination pair. the parameters should decay if the address hasn't been used for a long enough time period 🌸.
- For each destination address, an endpoint does slow start upon the first transmission to that address 🎀.
Note: TCP guarantees in-sequence delivery of data to its upper-layer protocol within a single TCP session. so when TCP notices a gap in the received sequence number, it waits until the gap is filled before delivering the data that arrived with higher sequence numbers 🫶. SCTP is different. it can deliver data to its upper-layer protocol even when there's a gap in TSN, as long as the Stream Sequence Numbers are in sequence for a particular stream (meaning the missing DATA chunks belong to a different stream), or unordered delivery is indicated 🦋. this doesn't affect cwnd, but it might affect the rwnd calculation 💅.
7.2. SCTP Slow-Start and Congestion Avoidance
the slow-start and congestion avoidance algorithms MUST be used by an endpoint to control how much data it injects into the network 💖. SCTP's congestion control applies to the association, not to an individual stream ✨. in some situations it can be a good idea for an SCTP sender to be more conservative than the algorithms allow 🧚. but an SCTP sender MUST NOT be more aggressive than the following algorithms allow 💀.
like TCP, an SCTP endpoint uses the following three control variables to regulate its transmission rate 🌈.
- Receiver advertised window size (rwnd, in bytes). the receiver sets this based on its available buffer space for incoming packets 🍓.
Note: this variable is kept for the entire association 🎀.
- Congestion control window (cwnd, in bytes). the sender adjusts this based on observed network conditions 🔥.
Note: this variable is maintained on a per-destination-address basis 👑.
- Slow-start threshold (ssthresh, in bytes). the sender uses this to tell the slow-start and congestion avoidance phases apart 🌸.
Note: this variable is maintained on a per-destination-address basis 🫶.
SCTP also needs one more control variable, partial_bytes_acked. it gets used during the congestion avoidance phase to help adjust cwnd 💅.
Unlike TCP, an SCTP sender MUST keep a set of these control variables (cwnd, ssthresh, and partial_bytes_acked) for EACH destination address of its peer, when the peer is multi-homed 🙈. there's only one rwnd for the whole association, no matter whether the peer is multi-homed or has a single address ⭐.
7.2.1. Slow-Start
when data transmission begins into a network with unknown conditions, or after a sufficiently long idle period, SCTP has to probe the network to figure out the available capacity 🦋. the slow-start algorithm does this job at the beginning of a transfer, or after repairing loss detected by the retransmission timer ✨.
- The initial cwnd before DATA transmission, or after a sufficiently long idle period, MUST be set to
min(4*MTU, max (2*MTU, 4380 bytes))💖. - The initial cwnd after a retransmission timeout MUST be no more than 1*MTU 😭.
- The initial value of ssthresh MAY be arbitrarily high. for example, implementations MAY use the size of the receiver advertised window 🌈.
- Whenever cwnd is greater than zero, the endpoint is allowed to have cwnd bytes of data outstanding on that transport address 🧚.
- When cwnd is less than or equal to ssthresh, an SCTP endpoint MUST use the slow-start algorithm to increase cwnd, but only if three things are all true: the current congestion window is being fully utilized, an incoming SACK advances the Cumulative TSN Ack Point, and the data sender is not in Fast Recovery 🔥. cwnd can only be increased when all three conditions are met. otherwise, the cwnd MUST not be increased 💀. when they are met, cwnd MUST be increased by at most the lesser of 1) the total size of the previously outstanding DATA chunk(s) acknowledged, and 2) the destination's path MTU 👑. this upper bound protects against the ACK-Splitting attack outlined in [SAVAGE99] 🛡️.
when its peer endpoint is multi-homed, and an endpoint receives a SACK that advances its Cumulative TSN Ack Point, then it should update its cwnd (or cwnds) apportioned to the destination addresses it transmitted the acknowledged data to 🍓. however, if the received SACK does not advance the Cumulative TSN Ack Point, the endpoint MUST NOT adjust the cwnd of any destination address 🙈.
because an endpoint's cwnd is not tied to its Cumulative TSN Ack Point, duplicate SACKs can still be useful even when they don't advance the Cumulative TSN Ack Point 🌸. they can still clock out new data. the data newly acknowledged by the SACK shrinks the amount of data in flight to less than cwnd, so the current, unchanged cwnd now allows new data to be sent 🎀. but the increase of cwnd must be tied to the Cumulative TSN Ack Point advancement, as specified above 🫶. otherwise, duplicate SACKs wouldn't just clock out new data, they'd clock out more new data than what has just left the network, during a time of possible congestion 😭.
- When the endpoint does not transmit data on a given transport address, the cwnd of that transport address should be adjusted to
max(cwnd/2, 4*MTU)per RTO 💅.
7.2.2. Congestion Avoidance
when cwnd is greater than ssthresh, cwnd should be incremented by 1*MTU per RTT, provided the sender has cwnd or more bytes of data outstanding for the corresponding transport address ✨.
in practice, an implementation can hit this goal in the following way 🦋:
- partial_bytes_acked is initialized to 0 🌈.
- Whenever cwnd is greater than ssthresh, upon each SACK arrival that advances the Cumulative TSN Ack Point, increase partial_bytes_acked by the total number of bytes of all new chunks acknowledged in that SACK. this includes chunks acknowledged by the new Cumulative TSN Ack and by Gap Ack Blocks 🧚.
- When partial_bytes_acked is equal to or greater than cwnd, and before the arrival of the SACK the sender had cwnd or more bytes of data outstanding (i.e., before arrival of the SACK, flightsize was greater than or equal to cwnd), increase cwnd by MTU, and reset partial_bytes_acked to (partial_bytes_acked - cwnd) 💖.
- Same as in slow start, when the sender does not transmit DATA on a given transport address, the cwnd of that transport address should be adjusted to
max(cwnd / 2, 4*MTU)per RTO 🔥. - When all of the data transmitted by the sender has been acknowledged by the receiver, partial_bytes_acked is initialized to 0 👑.
7.2.3. Congestion Control
upon detecting packet losses from SACK (see Section 7.2.4), an endpoint should do the following 🌸:
ssthresh = max(cwnd/2, 4*MTU)
cwnd = ssthresh
partial_bytes_acked = 0basically, a packet loss causes cwnd to get cut in half 💀.
when the T3-rtx timer expires on an address, SCTP should perform slow start by doing this 🫶:
ssthresh = max(cwnd/2, 4*MTU)
cwnd = 1*MTUand it should make sure that no more than one SCTP packet is in flight for that address until the endpoint gets an acknowledgement for successful delivery of data to that address 🎀.
7.2.4. Fast Retransmit on Gap Reports ✨
okay so when there's no loss going on, an endpoint is chill and does delayed acknowledgement 💤. BUT the second it spots a hole in the arriving TSN sequence, it SHOULD start sending a SACK back every time a packet shows up carrying data, and keep doing that until the hole gets filled. ngl that's giving main character vigilance 👀
Whenever an endpoint gets a SACK saying some TSNs are missing, it SHOULD wait for two more miss indications (so, two more SACKs, for three missing reports total) on those same TSNs before it does anything about Fast Retransmit. patience is a virtue bestie 🫶
Miss indications SHOULD follow the HTNA (Highest TSN Newly Acknowledged) algorithm. For each incoming SACK, miss indications only go up for missing TSNs that come before the highest TSN newly acknowledged in that SACK. A newly acknowledged DATA chunk is one that wasn't already acknowledged in an earlier SACK. And if an endpoint is in Fast Recovery and a SACK shows up that moves the Cumulative TSN Ack Point forward, the miss indications go up for all TSNs reported missing in that SACK. 💅
When the third consecutive miss indication comes in for a TSN(s), the data sender shall do the following:
- Mark the DATA chunk(s) with three miss indications for retransmission. 🔥
- If not in Fast Recovery, adjust the ssthresh and cwnd of the destination address(es) to which the missing DATA chunks were last sent, according to the formula described in Section 7.2.3. 📉
- Figure out how many of the earliest (i.e., lowest TSN) DATA chunks marked for retransmission will fit into a single packet, subject to the constraint of the path MTU of the destination transport address the packet is headed to. Call this value K. Retransmit those K DATA chunks in a single packet. When a Fast Retransmit is happening, the sender SHOULD ignore the value of cwnd and SHOULD NOT delay retransmission for this single packet. 🚀
- Restart the T3-rtx timer only if the last SACK acknowledged the lowest outstanding TSN number sent to that address, or the endpoint is retransmitting the first outstanding DATA chunk sent to that address. ⏱️
- Mark the DATA chunk(s) as being fast retransmitted and thus ineligible for a subsequent Fast Retransmit. Those TSNs marked for retransmission due to the Fast-Retransmit algorithm that didn't fit in the sent datagram carrying K other TSNs are also marked as ineligible for a subsequent Fast Retransmit. However, as they are marked for retransmission they will be retransmitted later on as soon as cwnd allows. 🦋
- If not in Fast Recovery, enter Fast Recovery and mark the highest outstanding TSN as the Fast Recovery exit point. When a SACK acknowledges all TSNs up to and including this exit point, Fast Recovery is exited. While in Fast Recovery, the ssthresh and cwnd SHOULD NOT change for any destinations due to a subsequent Fast Recovery event (i.e., one SHOULD NOT reduce the cwnd further due to a subsequent Fast Retransmit). 🛑
Note: Before the above adjustments, if the received SACK also acknowledges new DATA chunks and advances the Cumulative TSN Ack Point, the cwnd adjustment rules defined in Section 7.2.1 and Section 7.2.2 must be applied first.
A straightforward implementation of the above keeps a counter for each TSN hole reported by a SACK. The counter goes up for each consecutive SACK reporting that TSN hole. Once it hits 3 and the Fast-Retransmit procedure starts, the counter resets to 0. 🧮
Because cwnd in SCTP indirectly bounds the number of outstanding TSN's, the effect of TCP Fast Recovery is achieved automatically with no adjustment to the congestion control window size. it's literally so efficient, I'm obsessed 😭✨
7.3. Path MTU Discovery
[RFC4821], [RFC1981], and [RFC1191] specify "Packetization Layer Path MTU Discovery", where an endpoint keeps an estimate of the maximum transmission unit (MTU) along a given Internet path and avoids sending packets along that path that exceed the MTU, except for the occasional attempt to probe for a change in the Path MTU (PMTU). [RFC4821] is super thorough about the MTU discovery mechanism and about strategies for figuring out the current end-to-end MTU setting and spotting changes in that value. 🌈
An endpoint SHOULD apply these techniques, and SHOULD do so on a per-destination-address basis. 🎀
There are two important SCTP-specific points about Path MTU discovery: 🦋
- SCTP associations can span multiple addresses. An endpoint MUST maintain separate MTU estimates for each destination address of its peer. 📍
- The sender should track an association PMTU that will be the smallest PMTU discovered for all of the peer's destination addresses. When fragmenting messages into multiple parts, this association PMTU should be used to calculate the size of each fragment. This will allow retransmissions to be seamlessly sent to an alternate address without encountering IP fragmentation. 🧚
8. Fault Management 🛡️
8.1. Endpoint Failure Detection
An endpoint shall keep a counter on the total number of consecutive retransmissions to its peer (this includes retransmissions to all the destination transport addresses of the peer if it is multi-homed), including unacknowledged HEARTBEAT chunks. If the value of this counter exceeds the limit indicated in the protocol parameter 'Association.Max.Retrans', the endpoint shall consider the peer endpoint unreachable and shall stop transmitting any more data to it (and thus the association enters the CLOSED state). In addition, the endpoint MAY report the failure to the upper layer and optionally report back all outstanding user data remaining in its outbound queue. The association is automatically closed when the peer endpoint becomes unreachable. 🚪
The counter shall be reset each time a DATA chunk sent to that peer endpoint is acknowledged (by the reception of a SACK) or a HEARTBEAT ACK is received from the peer endpoint. 🔄
8.2. Path Failure Detection
When its peer endpoint is multi-homed, an endpoint should keep an error counter for each of the destination transport addresses of the peer endpoint. 🗂️
Each time the T3-rtx timer expires on any address, or when a HEARTBEAT sent to an idle address is not acknowledged within an RTO, the error counter of that destination address will be incremented. When the value in the error counter exceeds the protocol parameter 'Path.Max.Retrans' of that destination address, the endpoint should mark the destination transport address as inactive, and a notification SHOULD be sent to the upper layer. 🚨
When an outstanding TSN is acknowledged or a HEARTBEAT sent to that address is acknowledged with a HEARTBEAT ACK, the endpoint shall clear the error counter of the destination transport address to which the DATA chunk was last sent (or HEARTBEAT was sent). When the peer endpoint is multi-homed and the last chunk sent to it was a retransmission to an alternate address, there's an ambiguity about whether the acknowledgement should be credited to the address of the last chunk sent. However, this ambiguity does not seem to bear any significant consequence to SCTP behavior. If this ambiguity is undesirable, the transmitter may choose not to clear the error counter if the last chunk sent was a retransmission. 🤔
Note: When configuring the SCTP endpoint, the user should avoid having the value of 'Association.Max.Retrans' larger than the summation of the 'Path.Max.Retrans' of all the destination addresses for the remote endpoint. Otherwise, all the destination addresses may become inactive while the endpoint still considers the peer endpoint reachable. When this condition occurs, how SCTP chooses to function is implementation specific. 🙈
When the primary path is marked inactive (due to excessive retransmissions, for instance), the sender MAY automatically transmit new packets to an alternate destination address if one exists and is active. If more than one alternate address is active when the primary path is marked inactive, only ONE transport address SHOULD be chosen and used as the new destination transport address. 💜
8.3. Path Heartbeat 💖
okay so by default, an SCTP endpoint SHOULD keep an eye on whether its peer's idle destination transport addresses are still reachable 👀 It does this by sending a HEARTBEAT chunk now and then to those destination transport addresses. Heartbeating MAY start once you hit the ESTABLISHED state, and it stops after you send either SHUTDOWN or SHUTDOWN-ACK. The receiver of a HEARTBEAT MUST reply with a HEARTBEAT-ACK once it's in COOKIE-ECHOED (if it's the INIT sender) or ESTABLISHED (if it's the INIT receiver). It keeps replying until it reaches SHUTDOWN-SENT (if it's the SHUTDOWN sender) or SHUTDOWN-ACK-SENT (if it's the SHUTDOWN receiver). Bestie, that's the whole vibe 🫶
A destination transport address counts as "idle" when no new chunk that can update the path RTT has gone to it (usually that means first-transmission DATA, INIT, COOKIE ECHO, HEARTBEAT, and so on), and no HEARTBEAT has been sent to it within that address's current heartbeat period. This applies to active and inactive destination addresses alike 🦋
The upper layer can optionally start any of these functions:
A) Disable heartbeat on a specific destination transport address of a given association,
B) Change the HB.interval,
C) Re-enable heartbeat on a specific destination transport address of a given association, and
D) Request an on-demand HEARTBEAT on a specific destination transport address of a given association.
The endpoint should bump the matching error counter for the destination transport address every time it sends a HEARTBEAT to that address and no ACK comes back within one RTO 🧚
Once that counter hits the protocol parameter Path.Max.Retrans, the endpoint should mark that destination address as inactive (if it isn't already), and it may also optionally tell the upper layer that the address's reachability changed. After that, the endpoint should keep heartbeating that destination address, but it should stop increasing the counter 🌸
The sender of a HEARTBEAT chunk should put two things in the Heartbeat Information field: the current time when the packet goes out, and the destination address the packet is headed to ⏰
IMPLEMENTATION NOTE: An alternative implementation of the heartbeat mechanism that can be used is to increment the error counter variable every time a HEARTBEAT is sent to a destination. Whenever a HEARTBEAT ACK arrives, the sender SHOULD clear the error counter of the destination that the HEARTBEAT was sent to. This in effect would clear the previously stroked error (and any other error counts as well).
The receiver of a HEARTBEAT should respond right away with a HEARTBEAT ACK. That ACK carries the Heartbeat Information TLV plus any other TLVs it received, copied over unchanged from the HEARTBEAT chunk 🍓
When the HEARTBEAT ACK shows up, the sender of the HEARTBEAT should clear the error counter of the destination transport address the HEARTBEAT went to, and mark that address as active if it isn't already. The endpoint may optionally tell the upper layer when an inactive destination address gets marked as active because of the newest HEARTBEAT ACK. The receiver of the HEARTBEAT ACK must also clear the association overall error count too (as defined in Section 8.1) ✨
The receiver of the HEARTBEAT ACK should also do an RTT measurement for that destination transport address, using the time value carried in the HEARTBEAT ACK chunk 📊
For an idle destination address that's allowed to heartbeat, it is recommended that a HEARTBEAT chunk gets sent once per RTO of that destination address plus the protocol parameter HB.interval. There's jittering of +/- 50% of the RTO value, and the RTO gets exponential backoff if the previous HEARTBEAT goes unanswered 🎀
There's a primitive so the SCTP user can change the HB.interval and turn heartbeat on or off for a given destination address. The heartbeat interval the SCTP user sets gets added to that destination's RTO (including any exponential backoff). Only one heartbeat should go out each time the heartbeat timer expires, if several destinations are idle. How the endpoint picks which idle destination to heartbeat is an implementation decision (if more than one destination is idle) 💅
Note: When tuning the heartbeat interval, there is a side effect that SHOULD be taken into account. When this value goes up, meaning the HEARTBEAT takes longer, detecting lost ABORT messages takes longer too. If a peer endpoint ABORTs the association for any reason and that ABORT chunk gets lost, the local endpoint will only find out about the lost ABORT by sending a DATA chunk or HEARTBEAT chunk (which makes the peer send another ABORT). This must be considered when tuning the HEARTBEAT timer. If the HEARTBEAT is disabled, only sending DATA to the association will discover a lost ABORT from the peer. 🙈
8.4. Handle "Out of the Blue" Packets 🌈
An SCTP packet is called an "out of the blue" (OOTB) packet when it's correctly formed (meaning it passed the receiver's CRC32c check; see Section 6.8), but the receiver can't figure out which association it belongs to 🕵️♀️
The receiver of an OOTB packet MUST do the following:
- If the OOTB packet is to or from a non-unicast address, a receiver SHOULD silently discard the packet. Otherwise,
- If the OOTB packet contains an ABORT chunk, the receiver MUST silently discard the OOTB packet and take no further action. Otherwise,
- If the packet contains an INIT chunk with a Verification Tag set to
'0', process it as described in Section 5.1. If, for whatever reason, the INIT can't be processed normally and an ABORT has to be sent back, the Verification Tag of the packet containing the ABORT chunk MUST be the Initiate Tag of the received INIT chunk, and the T bit of the ABORT chunk has to be set to 0, which says that the Verification Tag is NOT reflected. 🙅♀️ - If the packet contains a COOKIE ECHO in the first chunk, process it as described in Section 5.1. Otherwise,
- If the packet contains a SHUTDOWN ACK chunk, the receiver should reply to the sender of the OOTB packet with a SHUTDOWN COMPLETE. When sending the SHUTDOWN COMPLETE, the receiver of the OOTB packet must fill in the Verification Tag field of the outbound packet with the Verification Tag received in the SHUTDOWN ACK, and set the T bit in the Chunk Flags to show that the Verification Tag is reflected. Otherwise,
- If the packet contains a SHUTDOWN COMPLETE chunk, the receiver should silently discard the packet and take no further action. Otherwise,
- If the packet contains a "Stale Cookie" ERROR or a COOKIE ACK, the SCTP packet should be silently discarded. Otherwise,
- The receiver should reply to the sender of the OOTB packet with an ABORT. When sending the ABORT, the receiver of the OOTB packet MUST fill in the Verification Tag field of the outbound packet with the value found in the Verification Tag field of the OOTB packet, and set the T bit in the Chunk Flags to show that the Verification Tag is reflected. After sending this ABORT, the receiver of the OOTB packet shall discard the OOTB packet and take no further action. 🫠
8.5. Verification Tag 🔑
The Verification Tag rules in this section apply when you're sending or receiving SCTP packets that don't contain an INIT, SHUTDOWN COMPLETE, COOKIE ECHO (see Section 5.1), ABORT, or SHUTDOWN ACK chunk. Packets with one of those chunk types get their own rules, which are discussed separately in Section 8.5.1 💅
When sending an SCTP packet, the endpoint MUST fill in the Verification Tag field of the outbound packet with the tag value from the Initiate Tag parameter of the INIT or INIT ACK it got from its peer 🎀
When receiving an SCTP packet, the endpoint MUST make sure the value in the Verification Tag field of the received packet matches its own tag. If the received Verification Tag doesn't match the receiver's own tag value, the receiver shall silently discard the packet and shall not process it any further, except for the cases listed in Section 8.5.1 below. Not me ignoring the wrong tag 🙄
8.5.1. Exceptions in Verification Tag Rules 🧚
A) Rules for packet carrying INIT:
- The sender MUST set the Verification Tag of the packet to 0.
- When an endpoint receives an SCTP packet with the Verification Tag set to 0, it should verify that the packet contains only an INIT chunk. Otherwise, the receiver MUST silently discard the packet.
B) Rules for packet carrying ABORT:
- The endpoint MUST always fill in the Verification Tag field of the outbound packet with the destination endpoint's tag value, if it is known.
- If the ABORT is sent in response to an OOTB packet, the endpoint MUST follow the procedure described in Section 8.4.
- The receiver of an ABORT MUST accept the packet if the Verification Tag field of the packet matches its own tag and the T bit is not set, OR if it is set to its peer's tag and the T bit is set in the Chunk Flags. Otherwise, the receiver MUST silently discard the packet and take no further action. 💀
C) Rules for packet carrying SHUTDOWN COMPLETE:
- When sending a SHUTDOWN COMPLETE, if the receiver of the SHUTDOWN ACK has a TCB, then the destination endpoint's tag MUST be used, and the T bit MUST NOT be set. Only where no TCB exists should the sender use the Verification Tag from the SHUTDOWN ACK, and MUST set the T bit.
- The receiver of a SHUTDOWN COMPLETE shall accept the packet if the Verification Tag field of the packet matches its own tag and the T bit is not set, OR if it is set to its peer's tag and the T bit is set in the Chunk Flags. Otherwise, the receiver MUST silently discard the packet and take no further action. An endpoint MUST ignore the SHUTDOWN COMPLETE if it is not in the
SHUTDOWN-ACK-SENTstate. 🦋
D) Rules for packet carrying a COOKIE ECHO
- When sending a COOKIE ECHO, the endpoint MUST use the value of the Initiate Tag received in the INIT ACK.
- The receiver of a COOKIE ECHO follows the procedures in Section 5.
E) Rules for packet carrying a SHUTDOWN ACK
- If the receiver is in
COOKIE-ECHOEDorCOOKIE-WAITstate, the procedures in Section 8.4 SHOULD be followed. In other words, it should be treated as an Out Of The Blue packet. 🕵️♀️
9. Termination of Association 👑
An endpoint should terminate its association when it exits from service. An association can be ended by either abort or shutdown. An abort is abortive by definition, meaning any data pending on either end of the association gets thrown out and never delivered to the peer 💔 A shutdown is a graceful close, where all data in the queue from either endpoint gets delivered to the respective peers ✨ Heads up, though: with a shutdown, SCTP doesn't support a half-open state (unlike TCP), where one side keeps sending data while the other end is closed. When either endpoint does a shutdown, the association on each peer stops accepting new data from its user, and it only delivers the data that was already in the queue when the SHUTDOWN chunk was sent or received 🫶
9.1. Abort of an Association 🚨
okay so when an endpoint decides to abort an existing association, it MUST send an ABORT chunk to its peer endpoint 💅 the sender MUST fill in the peer's Verification Tag in the outbound packet, and it MUST NOT bundle any DATA chunk with the ABORT 🙅♀️ if the association is aborted because the upper layer asked for it, a User-Initiated Abort error cause (see Section 3.3.10.12) SHOULD be present in the ABORT chunk 🎀
an endpoint MUST NOT respond to any received packet that contains an ABORT chunk (also see Section 8.4) 🤐 bestie, that's a whole vibe check, no replies allowed ✨
an endpoint receiving an ABORT MUST apply the special Verification Tag check rules described in Section 8.5.1 🔍
after checking the Verification Tag, the receiving endpoint MUST remove the association from its record 🗑️ and it SHOULD report the termination to its upper layer 📣 if a User-Initiated Abort error cause is in the ABORT chunk, the Upper Layer Abort Reason SHOULD be made available to the upper layer 🧚
9.2. Shutdown of an Association 🌸
using the SHUTDOWN primitive (see Section 10.1), the upper layer of an endpoint in an association can close the association gracefully 🫶 this lets all the outstanding DATA chunks from the peer of the shutdown initiator get delivered before the association ends, which is so considerate of it 🥹
when the upper layer hands the endpoint the SHUTDOWN primitive, the endpoint goes into the SHUTDOWN-PENDING state and stays there until its peer has acknowledged all the outstanding data 🧘♀️ it accepts no new data from its upper layer, but it will retransmit data to the far end if it needs to fill gaps 🔁
once all its outstanding data is acknowledged, the endpoint shall send a SHUTDOWN chunk to its peer, and in the Cumulative TSN Ack field it puts the last sequential TSN it has received from the peer 📦 then it shall start the T2-shutdown timer and enter the SHUTDOWN-SENT state ⏱️ if that timer expires, the endpoint must resend the SHUTDOWN with the updated last sequential TSN it received from its peer 🔄
the rules in Section 6.3 MUST be followed to figure out the right timer value for T2-shutdown 🧮 and to point out any gaps in the TSN, the endpoint may also bundle a SACK with the SHUTDOWN chunk in the same SCTP packet 💫
an endpoint should limit how many times it retransmits the SHUTDOWN chunk to the protocol parameter 'Association.Max.Retrans' 🙃 if that threshold gets exceeded, the endpoint should destroy the TCB, and it MUST report the peer endpoint as unreachable to the upper layer 🚫 (so the association enters the CLOSED state, periodt 💀) any packet arriving from the peer (like when the peer sends all of its queued DATA chunks) should clear the endpoint's retransmission count and restart the T2-shutdown timer 🌈 that gives the peer plenty of room to send the queued DATA chunks it hasn't sent yet, which is giving generous energy 🍓
when the SHUTDOWN shows up, the peer endpoint shall:
- enter the
SHUTDOWN-RECEIVEDstate 🧃, - stop accepting new data from its SCTP user 🚪, and
- verify, by checking the Cumulative TSN Ack field of the chunk, that the SHUTDOWN sender has received all of its outstanding DATA chunks 🔎.
once an endpoint has reached the SHUTDOWN-RECEIVED state, it MUST NOT send a SHUTDOWN in response to a ULP request 🙅 and it should throw away any later SHUTDOWN chunks 🗑️
if there are still outstanding DATA chunks left, the SHUTDOWN receiver MUST keep following the normal data transmission procedures defined in Section 6 until every outstanding DATA chunk is acknowledged 📬 however, the SHUTDOWN receiver MUST NOT accept new data from its SCTP user, because boundaries are boundaries 🛑
while in the SHUTDOWN-SENT state, the SHUTDOWN sender MUST immediately answer each received packet that has one or more DATA chunks with a SHUTDOWN chunk, and it MUST restart the T2-shutdown timer ⚡ if a SHUTDOWN chunk can't acknowledge all of the received DATA chunks by itself (meaning there are TSNs bigger than the cumulative TSN that could be acknowledged, so gaps exist in the TSN sequence), or if duplicate TSNs were received, then a SACK chunk MUST also be sent 🧩
the sender of the SHUTDOWN MAY also start an overall guard timer 'T5-shutdown-guard' to cap the total time the shutdown sequence can take ⏳ when this timer expires, the sender SHOULD abort the association by sending an ABORT chunk 🛎️ if the 'T5-shutdown-guard' timer is used, it SHOULD be set to the recommended value of 5 times 'RTO.Max' 🎯
if the receiver of the SHUTDOWN has no more outstanding DATA chunks, the SHUTDOWN receiver MUST send a SHUTDOWN ACK and start its own T2-shutdown timer, entering the SHUTDOWN-ACK-SENT state 🤝 if that timer expires, the endpoint must resend the SHUTDOWN ACK 🔁
the sender of the SHUTDOWN ACK should limit how many times it retransmits the SHUTDOWN ACK chunk to the protocol parameter 'Association.Max.Retrans' 📉 if that threshold is exceeded, the endpoint should destroy the TCB and may report the peer endpoint as unreachable to the upper layer (so the association enters the CLOSED state 🫠)
when the SHUTDOWN ACK arrives, the SHUTDOWN sender shall stop the T2-shutdown timer, send a SHUTDOWN COMPLETE chunk to its peer, and remove all record of the association 🧹 ✨
when the SHUTDOWN COMPLETE chunk comes in, the endpoint will verify that it is in the SHUTDOWN-ACK-SENT state 👀 if it isn't, the chunk should be discarded 🚮 if it is in the SHUTDOWN-ACK-SENT state, the endpoint should stop the T2-shutdown timer and remove all knowledge of the association (so the association enters the CLOSED state, and that's the end of that era 🎬)
an endpoint SHOULD make sure all its outstanding DATA chunks have been acknowledged before it starts the shutdown procedure 📋
an endpoint should reject any new data request from its upper layer if it is in the SHUTDOWN-PENDING, SHUTDOWN-SENT, SHUTDOWN-RECEIVED, or SHUTDOWN-ACK-SENT state 🙅♀️
if an endpoint is in the SHUTDOWN-ACK-SENT state and gets an INIT chunk (for example, because the SHUTDOWN COMPLETE got lost) with source and destination transport addresses (either in the IP addresses or in the INIT chunk) that belong to this association, it should discard the INIT chunk and retransmit the SHUTDOWN ACK chunk 🔁🫶
Note: getting an INIT with the same source and destination IP addresses as the transport addresses assigned to an endpoint, but with a different port number, means a separate association is being initialized 🦋
the sender of the INIT or COOKIE ECHO should respond to a SHUTDOWN ACK with a stand-alone SHUTDOWN COMPLETE in an SCTP packet, and the Verification Tag field of its common header should be set to the same tag that came in the SHUTDOWN ACK packet 📮 this counts as an Out of the Blue packet as defined in Section 8.4 👽 the sender of the INIT lets T1-init keep running and stays in the COOKIE-WAIT or COOKIE-ECHOED state 🕰️ when T1-init expires normally, the INIT or COOKIE chunk gets retransmitted and that starts a new association 🌱
if a SHUTDOWN is received in the COOKIE-WAIT or COOKIE ECHOED state, the SHUTDOWN chunk SHOULD be silently discarded 🤫
if an endpoint is in the SHUTDOWN-SENT state and gets a SHUTDOWN chunk from its peer, the endpoint shall respond right away with a SHUTDOWN ACK to its peer, and move into the SHUTDOWN-ACK-SENT state while restarting its T2-shutdown timer 🏃♀️💨
if an endpoint is in the SHUTDOWN-ACK-SENT state and gets a SHUTDOWN ACK, it shall stop the T2-shutdown timer, send a SHUTDOWN COMPLETE chunk to its peer, and remove all record of the association 🎉
10. Interface with Upper Layer 🧚♀️
the Upper Layer Protocols (ULPs) shall request services by passing primitives to SCTP, and they shall receive notifications from SCTP for various events 📨
the primitives and notifications in this section should be used as a guideline for implementing SCTP 🗺️ the functional description of the ULP interface primitives below is shown for illustrative purposes only 🖍️ different SCTP implementations may have different ULP interfaces 🌷 however, all SCTPs must provide a certain minimum set of services so that every SCTP implementation can support the same protocol hierarchy 🫂
10.1. ULP-to-SCTP 📞
the following sections functionally describe a ULP/SCTP interface 🧑💻 the notation is similar to most procedure or function calls in high-level languages 💜
the ULP primitives described below specify the basic functions SCTP must perform to support inter-process communication 💬 individual implementations must define their own exact format, and they may provide combinations or subsets of the basic functions in single calls 🍰
A) Initialize ✨
Format: INITIALIZE ([local port],[local eligible address list])->
local SCTP instance namethis primitive lets SCTP initialize its internal data structures and allocate the resources it needs to set up its operating environment 🏗️ once SCTP is initialized, the ULP can talk directly to other endpoints without invoking this primitive again 🔓
SCTP will return a local SCTP instance name to the ULP 🏷️
Mandatory attributes:
None.
Optional attributes:
The following types of attributes may be passed along with the primitive:
- local port - SCTP port number, if the ULP wants it to be specified 🔢
- local eligible address list - an address list that the local SCTP endpoint should bind 📍 by default, if an address list is not included, all IP addresses assigned to the host should be used by the local endpoint 🌐
IMPLEMENTATION NOTE: if this optional attribute is supported by an implementation, it will be the responsibility of the implementation to enforce that the IP source address field of any SCTP packets sent out by this endpoint contains one of the IP addresses indicated in the local eligible address list 🛡️
B) Associate 🤝
Format: ASSOCIATE(local SCTP instance name,
destination transport addr, outbound stream count)
-> association id [,destination transport addr list]
[,outbound stream count]this primitive lets the upper layer start an association with a specific peer endpoint 💖
the peer endpoint shall be specified by one of the transport addresses that defines the endpoint (see Section 1.3) 📌 if the local SCTP instance hasn't been initialized, the ASSOCIATE is considered an error 🙈
an association id, which is a local handle to the SCTP association, will be returned when the association is successfully established 🎟️ if SCTP can't open an SCTP association with the peer endpoint, an error is returned 😬
other association parameters may be returned too, including the complete destination transport addresses of the peer and the outbound stream count of the local endpoint 📊 the local endpoint will select one of the transport addresses from the returned destination addresses as the default primary path for sending SCTP packets to this peer 🛣️ the returned "destination transport addr list" can be used by the ULP to change the default primary path or to force a packet to go to a specific transport address 🎯
IMPLEMENTATION NOTE: if the ASSOCIATE primitive is implemented as a blocking function call, it can return association parameters in addition to the association id when the establishment succeeds 🧱 if the ASSOCIATE primitive is implemented as a non-blocking call, only the association id shall be returned, and the association parameters shall be passed using the COMMUNICATION UP notification 📬
Mandatory attributes:
- local SCTP instance name: grabbed straight from the INITIALIZE operation 🎀
- destination transport addr: one of the transport addresses of the peer endpoint you want to link up with 🦋
- outbound stream count: how many outbound streams the ULP would like to open toward this peer endpoint 🌸
Optional attributes:
None. ✨
C) Shutdown
Format: SHUTDOWN(association id)
-> resultThis is the graceful exit, bestie 🫶. Any locally queued user data gets delivered to the peer first, and the association only terminates after the peer acknowledges all the SCTP packets sent. A success code is returned on successful termination of the association. If attempting to terminate it results in a failure, an error code shall be returned.
Mandatory attributes:
- association id: local handle to the SCTP association 🔑
Optional attributes:
None.
D) Abort
Format: ABORT(association id [, Upper Layer Abort Reason]) ->
resultThis is the ungraceful rage-quit option 💀. Any locally queued user data gets discarded, and an ABORT chunk is sent to the peer. A success code is returned on successful abort of the association. If attempting to abort it results in a failure, an error code shall be returned.
Mandatory attributes:
- association id: local handle to the SCTP association 🔑
Optional attributes:
- Upper Layer Abort Reason: the reason for the abort, passed along to the peer 📝
None.
E) Send
Format: SEND(association id, buffer address, byte count [,context]
[,stream id] [,life time] [,destination transport address]
[,unordered flag] [,no-bundle flag] [,payload protocol-id] )
-> resultThis is the main method for sending user data via SCTP, main character energy 👑.
Mandatory attributes:
- association id: local handle to the SCTP association 🔑
- buffer address: the location where the user message to be transmitted is stored 📦
- byte count: the size of the user data in bytes 🔢
Optional attributes:
- context: an optional 32-bit integer that gets carried in the sending failure notification to the ULP if transporting this user message fails 🏷️
- stream id: which stream to send the data on. If not specified, stream 0 is used 🌈
- life time: how long the user data lives. It won't be sent by SCTP after the life time expires, which helps avoid wasting effort on stale messages ⏳ SCTP notifies the ULP if the data can't be initiated to transport (i.e., sent to the destination via SCTP's send primitive) within the life time. However, the user data will still be transmitted if SCTP has attempted to transmit a chunk before the life time expired.
IMPLEMENTATION NOTE: For better support of the data life time option, the transmitter may hold back assigning the TSN number to an outbound DATA chunk until the last moment. And for implementation simplicity, once a TSN number has been assigned, the sender should consider the send of this DATA chunk as committed, overriding any life time option attached to the DATA chunk. 🧠
- destination transport address: one of the destination transport addresses of the peer endpoint this packet should go to. Whenever possible, SCTP should use this address instead of the current primary path 🛤️
- unordered flag: if present, the user wants the data delivered unordered to the peer (the U flag is set to 1 on all DATA chunks carrying this message) 🦋
- no-bundle flag: tells SCTP not to bundle this user data with other outbound DATA chunks. SCTP MAY still bundle even with this flag present when faced with network congestion 🚫
- payload protocol-id: a 32-bit unsigned integer passed to the peer, indicating the type of payload protocol data being transmitted. SCTP treats it as opaque data 💜
F) Set Primary
Format: SETPRIMARY(association id, destination transport address,
[source transport address] )
-> resultThis tells the local SCTP to use the specified destination transport address as the primary path for sending packets 🛣️✨.
The result of attempting this operation shall be returned. If the specified destination transport address isn't in the "destination transport address list" returned earlier in an associate command or communication up notification, an error shall be returned.
Mandatory attributes:
- association id: local handle to the SCTP association 🔑
- destination transport address: one of the transport addresses of the peer endpoint that should be used as the primary address for sending packets. This overrides the current primary address info the local SCTP endpoint keeps 👑
Optional attributes:
- source transport address: some implementations may let you set the default source address placed in all outgoing IP datagrams 🎀
G) Receive
Format: RECEIVE(association id, buffer address, buffer size
[,stream id])
-> byte count [,transport address] [,stream id] [,stream sequence
number] [,partial flag] [,delivery number] [,payload protocol-id]This primitive shall read the first user message in the SCTP in-queue into the buffer the ULP specified, if there's one available. The size of the message read, in bytes, gets returned. Depending on the implementation, it may also return other info like the sender's address, the stream id it came in on, whether more messages are waiting, etc. For ordered messages, their Stream Sequence Number may also be returned 📬.
Depending on the implementation, if this primitive is invoked when no message is available, the implementation should return an indication of this condition, or should block the invoking process until data does become available. 💤
Mandatory attributes:
- association id: local handle to the SCTP association 🔑
- buffer address: the memory location the ULP set aside to store the received message 📦
- buffer size: the maximum amount of data to receive, in bytes 📏
Optional attributes:
- stream id: which stream to receive the data on 🌈
- Stream Sequence Number: the Stream Sequence Number assigned by the sending SCTP peer 🔢
- partial flag: if this returned flag is set to 1, this Receive contains a partial delivery of the whole message. When this flag is set, the stream id and Stream Sequence Number MUST accompany this receive. When it's set to 0, no more deliveries will come for this Stream Sequence Number 🧩
- payload protocol-id: a 32-bit unsigned integer received from the peer, indicating the type of payload protocol of the received data. SCTP treats it as opaque data 💜
H) Status
Format: STATUS(association id)
-> status dataThis primitive should return a data block with the following info, which is giving full dashboard vibes 📊🌸:
- association connection state,
- destination transport address list,
- destination transport address reachability states,
- current receiver window size,
- current congestion window sizes,
- number of unacknowledged DATA chunks,
- number of DATA chunks pending receipt,
- primary path,
- most recent SRTT on primary path,
- RTO on primary path,
- SRTT and RTO on other destination addresses, etc.
Mandatory attributes:
- association id: local handle to the SCTP association 🔑
Optional attributes:
None.
I) Change Heartbeat
Format: CHANGE HEARTBEAT(association id,
destination transport address, new state [,interval])
-> resultThis tells the local endpoint to enable or disable heartbeat on the specified destination transport address 💓.
The result of attempting this operation shall be returned.
Note: Even when enabled, heartbeat won't happen if the destination transport address isn't idle. 🙈
Mandatory attributes:
- association id: local handle to the SCTP association 🔑
- destination transport address: one of the transport addresses of the peer endpoint 🦋
- new state: the new heartbeat state for this destination transport address, either enabled or disabled 🔀
Optional attributes:
- interval: if present, sets how often the heartbeat happens when enabling heartbeat on a destination transport address. This value is added to the RTO of the destination transport address. If present, it affects all destinations ⏰
J) Request HeartBeat
Format: REQUESTHEARTBEAT(association id, destination transport
address)
-> resultThis tells the local endpoint to perform a HeartBeat on the specified destination transport address of the given association 💌. The returned result should indicate whether the transmission of the HEARTBEAT chunk to the destination address was successful.
Mandatory attributes:
- association id: local handle to the SCTP association 🔑
- destination transport address: the transport address of the association where a heartbeat should be issued 🦋
K) Get SRTT Report
Format: GETSRTTREPORT(association id,
destination transport address)
-> srtt resultThis tells the local SCTP to report the current SRTT measurement on the specified destination transport address of the given association 📈. The returned result can be an integer holding the most recent SRTT, in milliseconds.
Mandatory attributes:
- association id: local handle to the SCTP association 🔑
- destination transport address: the transport address of the association where the SRTT measurement should be reported 🦋
L) Set Failure Threshold
Format: SETFAILURETHRESHOLD(association id, destination transport
address, failure threshold)
-> resultThis one lets the local SCTP customize the reachability failure detection threshold 'Path.Max.Retrans' for the specified destination address 🚦.
Mandatory attributes:
- association id: local handle to the SCTP association 🔑
- destination transport address: the transport address of the association where the failure detection threshold should be set 🦋
- failure threshold: the new value of 'Path.Max.Retrans' for the destination address 🔢
M) Set Protocol Parameters
Format: SETPROTOCOLPARAMETERS(association id,
[,destination transport address,]
protocol parameter list)
-> resultThis lets the local SCTP customize the protocol parameters 🎛️.
Mandatory attributes:
- association id: local handle to the SCTP association 🔑
- protocol parameter list: the specific names and values of the protocol parameters (e.g., Association.Max.Retrans; see Section 15) that the SCTP user wants to customize 📋
Optional attributes:
- destination transport address: some protocol parameters can be set on a per destination transport address basis 🦋
N) Receive Unsent Message
The receive calls are first, and they look like this 💅
Format: RECEIVE_UNSENT(data retrieval id, buffer address, buffer size [,stream id] [, stream sequence number] [,partial flag] [,payload protocol-id])
- data retrieval id: the ID SCTP passed to the ULP in the failure notification 🎀
- buffer address: the memory spot the ULP picked to store the message you receive 🧚
- buffer size: the max amount of data you can take in, in bytes 📏
Optional attributes: 🌸
- stream id: a return value that tells you which stream the data was sent on ✨
- Stream Sequence Number: also returned, and it's the number attached to the message 🔢
- partial flag: if this one comes back as 1, the message is only a partial delivery of the whole thing. When it's set, the stream id and Stream Sequence Number MUST come along with this receive. When it's 0, no more deliveries are coming for that Stream Sequence Number, so you're done 🙌
- payload protocol-id: the 32-bit unsigned integer the peer sent along to say what kind of payload protocol the data is using 💜
Receive Unacknowledged Message 🦋
Format: RECEIVE_UNACKED(data retrieval id, buffer address, buffer size, [,stream id] [, stream sequence number] [,partial flag] [,payload protocol-id])
- data retrieval id: the ID passed to the ULP in the failure notification, same as before 🎀
- buffer address: the memory location the ULP set aside for the message 🧚
- buffer size: the most data you can receive, in bytes 📏
Optional attributes: 🌸
- stream id: returned to show which stream the data went to ✨
- Stream Sequence Number: returned with the Stream Sequence Number tied to the message 🔢
- partial flag: a returned flag. Set to 1 means it's a partial piece of the whole message. When that flag is set, the stream id and Stream Sequence Number MUST accompany this receive. Set to 0 means no more deliveries are coming for this Stream Sequence Number 🙌
- payload protocol-id: the 32-bit unsigned integer the peer was sent to tell you the payload protocol type of the received data 💜
P) Destroy SCTP Instance 💀
Format: DESTROY(local SCTP instance name)
- local SCTP instance name: the same value the application got during the initialize primitive, and it tells SCTP which instance to wipe out 🫶
10.2. SCTP-to-ULP
Okay so the operating system or app environment is assumed to give SCTP a way to asynchronously signal the ULP process 🔔 When SCTP does signal a ULP process, it passes certain info along.
IMPLEMENTATION NOTE: This might happen through a separate socket or error channel 🧚
A) DATA ARRIVE notification 📬
SCTP shall invoke this notification on the ULP when a user message is successfully received and ready to be retrieved ✨
It may optionally pass the following with the notification:
- association id: local handle to the SCTP association 🎀
- stream id: says which stream the data came in on 🌊
B) SEND FAILURE notification 💔
If a message can't be delivered, SCTP shall invoke this notification on the ULP 😭
It may optionally pass the following with the notification:
- association id: local handle to the SCTP association 🎀
- data retrieval id: an ID used to get back unsent and unacknowledged data 🔑
- cause code: tells you why it failed, like size too large or message life time expiring, etc. 💀
- context: optional info tied to this message (see D in Section 10.1) 🌸
C) NETWORK STATUS CHANGE notification 📡
When a destination transport address gets marked inactive (like when SCTP detects a failure) or marked active again (like when SCTP detects a recovery), SCTP shall invoke this notification on the ULP 🔄
The following shall be passed with the notification:
- association id: local handle to the SCTP association 🎀
- destination transport address: the destination transport address of the peer endpoint affected by the change 📍
- new-status: the new status 🚦
D) COMMUNICATION UP notification 🎉
This notification is used when SCTP becomes ready to send or receive user messages, or when lost communication with an endpoint gets restored 🙌
IMPLEMENTATION NOTE: If the ASSOCIATE primitive is implemented as a blocking function call, the association parameters come back as the result of the ASSOCIATE primitive itself. In that case, the COMMUNICATION UP notification is optional on the association initiator's side ✨
The following shall be passed with the notification:
- association id: local handle to the SCTP association 🎀
- status: says what type of event happened 🚦
- destination transport address list: the complete set of the peer's transport addresses 📋
- outbound stream count: the max number of streams the ULP is allowed to use in this association 📤
- inbound stream count: the number of streams the peer endpoint asked for with this association (this might not match the outbound stream count) 📥
E) COMMUNICATION LOST notification 😱
When SCTP completely loses communication with an endpoint (for example, through Heartbeats) or finds out the endpoint did an abort, it shall invoke this notification on the ULP 💔
The following shall be passed with the notification:
- association id: local handle to the SCTP association 🎀
- status: says what type of event happened. The status might mean a failure OR a normal termination that came from a shutdown or abort request 🚦
The following may be passed with the notification:
- data retrieval id: an ID used to get back unsent and unacknowledged data 🔑
- last-acked: the TSN last acked by that peer endpoint 🧾
- last-sent: the TSN last sent to that peer endpoint 📨
- Upper Layer Abort Reason: the abort reason given when the user started an abort 🛑
F) COMMUNICATION ERROR notification 🚨
When SCTP gets an ERROR chunk from its peer and decides to tell its ULP, it can invoke this notification on the ULP 👀
The following can be passed with the notification:
- association id: local handle to the SCTP association 🎀
- error info: the type of error, plus maybe some extra info that came in through the ERROR chunk 🔍
G) RESTART notification 🔁
When SCTP detects that the peer has restarted, it may send this notification to its ULP 🌅
The following can be passed with the notification:
- association id: local handle to the SCTP association 🎀
H) SHUTDOWN COMPLETE notification 🏁
When SCTP finishes the shutdown procedures (Section 9.2), this notification gets passed up to the upper layer 👑
The following can be passed with the notification:
- association id: local handle to the SCTP association 🎀
11. Security Considerations ✨
11.1. Security Objectives
Bestie, this part is the security vibe check 🔐 SCTP is a common transport protocol built to reliably carry time-sensitive user messages, like billing or signaling messages for telephony services, between two networked endpoints. Its security objectives are:
- availability of reliable and timely data transport services
- integrity of the user-to-user information carried by SCTP
11.2. SCTP Responses to Potential Threats
SCTP might end up in all kinds of risky situations 😬 It's super important for operators running SCTP to look at their own situation and pick the right countermeasures 🛡️
Operators of systems running SCTP should check out [RFC2196] for tips on securing their site 📚
11.2.1. Countering Insider Attacks
The principles of [RFC2196] should be applied to minimize the risk of information theft or sabotage by insiders 🕵️♀️ That includes publishing security policies, controlling access at the physical, software, and network levels, and separating services 🔒
11.2.2. Protecting against Data Corruption in the Network
If the risk of undetected errors in datagrams delivered by the lower-layer transport services is considered too high, extra integrity protection is required 😤 If that extra protection lived in the application layer, the SCTP header would still be vulnerable to deliberate integrity attacks 💀 The existing SCTP mechanisms for detecting packet replays are considered sufficient for normal operation, but stronger protections are needed when the operating environment has a significant risk of deliberate attacks from a sophisticated adversary 🚨
The SCTP Authentication extension SCTP-AUTH [RFC4895] MAY be used when the threat environment calls for stronger integrity protections, but it does not require confidentiality 🔏
11.2.3. Protecting Confidentiality
Most of the time, the confidentiality risk is about the signaling data payload, not the SCTP or lower-layer protocol overheads 🫶 If that's true, encrypting only the SCTP user data might be worth considering ✨ As with the supplementary checksum service, user data encryption MAY be performed by the SCTP user application. Alternatively, the user application MAY use an implementation-specific API to ask for the IP Encapsulating Security Payload (ESP) [RFC4303] to be used to provide confidentiality and integrity 🔐
Especially for mobile users, the confidentiality requirement might include masking IP addresses and ports 📱 In that case, ESP SHOULD be used instead of application-level confidentiality. If ESP is used to protect the confidentiality of SCTP traffic, an ESP cryptographic transform that includes cryptographic integrity protection MUST be used, because if there's a confidentiality threat, there's also a strong integrity threat 😭
Whenever ESP is in use, application-level encryption is not generally required 💅
Wherever confidentiality is provided, the Internet Key Exchange Protocol version 2 (IKEv2) [RFC4306] SHOULD be used for key management 🗝️
Operators should check out [RFC4301] for more info on the security services available at and right above the Internet Protocol layer 📖
11.2.4. Protecting against Blind Denial-of-Service Attacks
A blind attack is one where the attacker can't intercept or otherwise see the content of data flows going to and from the target SCTP node 🙈 Blind denial-of-service attacks can take the form of flooding, masquerade, or improper monopolization of services 🚫
11.2.4.1. Flooding 🌊
okay so the goal of flooding is to totally wreck a target by exhausting its resources, messing with legit transactions, and exploiting buffer-related software bugs 💀. The flood can aim at the SCTP node itself or at stuff in the intervening IP Access Links or the Internet. When those are the target, flooding looks like loss of network services, and it could even mean breaking through any firewalls in place 🧱
Protection against flooding starts at the equipment design level, and it's giving things like:
- avoiding commitment of limited resources before determining that the request for service is legitimate.
- giving priority to completion of processing in progress over the acceptance of new work.
- identification and removal of duplicate or stale queued requests for service.
- not responding to unexpected packets sent to non-unicast addresses.
Network equipment should be capable of generating an alarm and log if a suspicious increase in traffic occurs. 🚨 The log should include stuff like the identity of the incoming link and the source address(es) used, which helps the network or SCTP system operator take protective measures. Procedures should be in place for the operator to act on those alarms if a clear pattern of abuse shows up 💅
the design of SCTP is honestly resistant to flooding attacks ✨ especially because of its four-way startup handshake, its cookie that defers commitment of resources at the responding SCTP node until the handshake is done, and its Verification Tag, which blocks extraneous packets from getting inserted into an established association. iconic 👑
The IP Authentication Header and Encapsulating Security Payload might be useful in reducing the risk of certain kinds of denial-of-service attacks 🛡️
Now the host name feature in the INIT chunk, which is a whole mess 🙈 It could be used to flood a target DNS server. An attacker could build a big backlog of DNS queries, resolving the host name from the INIT chunk to IP addresses, just by sending INITs to multiple hosts in a given domain. An attacker could also do an indirect attack on a third party by sending large numbers of INITs to random hosts containing the host name of the target. On top of the strain on DNS resources, this could also result in large numbers of INIT ACKs being sent to the target 😭 One method to protect against this type of attack is to verify that the IP addresses received from DNS include the source IP address of the original INIT. If the list of IP addresses received from DNS does not include the source IP address of the INIT, the endpoint MAY silently discard the INIT. This last option will not protect against the attack against the DNS.
11.2.4.2. Blind Masquerade 🎭
Masquerade can be used to deny service in a few different ways:
- by tying up resources at the target SCTP node to which the impersonated node has limited access. For example, the target node may by policy permit a maximum of one SCTP association with the impersonated SCTP node. The masquerading attacker may attempt to establish an association purporting to come from the impersonated node so that the latter cannot do so when it requires it.
- by deliberately allowing the impersonation to be detected, thereby provoking counter-measures that cause the impersonated node to be locked out of the target SCTP node.
- by interfering with an established association by inserting extraneous content such as a SHUTDOWN request.
SCTP reduces the risk of blind masquerade attacks through IP spoofing by using the four-way startup handshake 🤝 Because the initial exchange is memory-less, no lockout mechanism gets triggered by blind masquerade attacks. Also, the INIT ACK containing the State Cookie is sent back to the IP address it got the INIT from, so the attacker would never receive the INIT ACK containing the State Cookie. SCTP protects against insertion of extraneous packets into the flow of an established association by using the Verification Tag, so no sneaky packets getting in 🙅♀️
Logging received INIT requests and abnormalities like unexpected INIT ACKs might be considered as a way to detect patterns of hostile activity. However, the potential usefulness of such logging must be weighed against the increased SCTP startup processing it implies, which makes the SCTP node more vulnerable to flooding attacks. Logging is pointless without operating procedures to review and analyze the logs on a routine basis 📋
11.2.4.3. Improper Monopolization of Services 👀
Attacks under this heading are performed openly and legitimately by the attacker 😤 They target fellow users of the target SCTP node or the shared resources between the attacker and the target node. Possible attacks include opening a large number of associations between the attacker's node and the target, or transferring large volumes of information within a legitimately established association.
Policy limits should be placed on the number of associations per adjoining SCTP node. SCTP user applications should be capable of detecting large volumes of illegitimate or "no-op" messages within a given association, and either logging or terminating the association as a result, based on local policy.
11.3. SCTP Interactions with Firewalls 🧱
Some firewalls are way happier if they can inspect just the first fragment of a fragmented SCTP packet and unambiguously determine whether it corresponds to an INIT chunk (for more info, check out [RFC1858]). So we're stressing the requirements from Section 3.1 🎀 Those are that (1) an INIT chunk MUST NOT be bundled with any other chunk in a packet, and (2) a packet containing an INIT chunk MUST have a zero Verification Tag. Furthermore, the receiver of an INIT chunk MUST enforce these rules by silently discarding an arriving packet with an INIT chunk that is bundled with other chunks or has a non-zero verification tag and contains an INIT-chunk.
11.4. Protection of Non-SCTP-Capable Hosts 🫶
To give a non-SCTP-capable host the same level of protection against attacks as SCTP-capable ones, all SCTP stacks MUST implement the ICMP handling described in Appendix C.
When an SCTP stack receives a packet containing multiple control or DATA chunks, and processing that packet requires sending multiple chunks in response, the sender of the response chunk(s) MUST NOT send more than one packet. If bundling is supported, multiple response chunks that fit into a single packet MAY be bundled together into one single response packet. If bundling is not supported, the sender MUST NOT send more than one response chunk and MUST discard all other responses. Note that this rule does not apply to a SACK chunk, since a SACK chunk is, in itself, a response to DATA and a SACK does not require a response of more DATA 🍓
An SCTP implementation SHOULD abort the association if it receives a SACK acknowledging a TSN that has not been sent. 🚫
An SCTP implementation that receives an INIT that would require a large packet in response, due to the inclusion of multiple ERROR parameters, MAY (at its discretion) elect to omit some or all of the ERROR parameters to make the INIT ACK smaller. Because of the combination of the size of the COOKIE parameter and the number of addresses a receiver of an INIT may be indicating to a peer, it is always possible that the INIT ACK will be larger than the original INIT. An SCTP implementation SHOULD attempt to make the INIT ACK as small as possible to reduce the possibility of byte amplification attacks 🌸
12. Network Management Considerations 📊
The MIB module for SCTP defined in [RFC3873] applies for the version of the protocol specified in this document.
13. Recommended Transmission Control Block (TCB) Parameters 🎀
This section details a recommended set of parameters that should be contained within the TCB for an implementation. It's here for illustrative purposes and should not be deemed as requirements on an implementation or as an exhaustive list of all parameters inside an SCTP TCB. Each implementation may need its own additional parameters for optimization ✨
13.1. Parameters Necessary for the SCTP Instance 🧚
- Associations: A list of current associations and their mappings to the data consumers for each association. This may be a hash table or another implementation-dependent structure. The data consumers may be process identification information such as file descriptors, named pipe pointers, or table pointers, depending on how SCTP is implemented.
- Secret Key: A secret key used by this endpoint to compute the MAC. This SHOULD be a cryptographic quality random number with a sufficient length. Discussion in RFC 4086 can be helpful in selecting the key 🔑
- Address List: The list of IP addresses that this instance has bound. This information is passed to one's peer(s) in INIT and INIT ACK chunks.
- SCTP Port: The local SCTP port number to which the endpoint is bound.
13.2. Parameters Necessary per Association (i.e., the TCB) 💖
okay so the TCB is basically the association's whole brain 🧠✨ here's everything it has to keep track of, bestie:
Peer : Tag value to be sent in every packet and is received
Verification: in the INIT or INIT ACK chunk.
Tag :
My : Tag expected in every inbound packet and sent in the
Verification: INIT or INIT ACK chunk.
Tag :
State : A state variable indicating what state the association
: is in, i.e., COOKIE-WAIT, COOKIE-ECHOED, ESTABLISHED,
: SHUTDOWN-PENDING, SHUTDOWN-SENT, SHUTDOWN-RECEIVED,
: SHUTDOWN-ACK-SENT.
Note: No "CLOSED" state is illustrated since if a
association is "CLOSED" its TCB SHOULD be removed.
Peer : A list of SCTP transport addresses to which the peer
Transport : is bound. This information is derived from the INIT or
Address : INIT ACK and is used to associate an inbound packet
List : with a given association. Normally, this information
: is hashed or keyed for quick lookup and access of the
: TCB.
Primary : This is the current primary destination transport
Path : address of the peer endpoint. It may also specify a
: source transport address on this endpoint.
Overall : The overall association error count.
Error Count :
Overall : The threshold for this association that if the Overall
Error : Error Count reaches will cause this association to be
Threshold : torn down.
Peer Rwnd : Current calculated value of the peer's rwnd.
Next TSN : The next TSN number to be assigned to a new DATA chunk.
: This is sent in the INIT or INIT ACK chunk to the peer
: and incremented each time a DATA chunk is assigned a
: TSN (normally just prior to transmit or during
: fragmentation).
Last Rcvd : This is the last TSN received in sequence. This value
TSN : is set initially by taking the peer's initial TSN,
: received in the INIT or INIT ACK chunk, and
: subtracting one from it.
Mapping : An array of bits or bytes indicating which out-of-
Array : order TSNs have been received (relative to the
: Last Rcvd TSN). If no gaps exist, i.e., no out-of-
: order packets have been received, this array will
: be set to all zero. This structure may be in the
: form of a circular buffer or bit array.
Ack State : This flag indicates if the next received packet
: is to be responded to with a SACK. This is initialized
: to 0. When a packet is received it is incremented.
: If this value reaches 2 or more, a SACK is sent and the
: value is reset to 0. Note: This is used only when no
: DATA chunks are received out of order. When DATA
: chunks are out of order, SACKs are not delayed (see
: Section 6).
Inbound : An array of structures to track the inbound streams,
Streams : normally including the next sequence number expected
: and possibly the stream number.
Outbound : An array of structures to track the outbound streams,
Streams : normally including the next sequence number to
: be sent on the stream.
Reasm Queue : A reassembly queue.
Local : The list of local IP addresses bound in to this
Transport : association.
Address :
List :
Association : The smallest PMTU discovered for all of the
PMTU : peer's transport addresses.13.3. Per Transport Address Data 🦋
so for every destination transport address in the peer's address list (the one you got from INIT or INIT ACK), you gotta keep a whole bunch of stuff too 📦 🌸
For each destination transport address in the peer's address list
derived from the INIT or INIT ACK chunk, a number of data elements
need to be maintained including:
Error Count : The current error count for this destination.
Error : Current error threshold for this destination, i.e.,
Threshold : what value marks the destination down if error count
: reaches this value.
cwnd : The current congestion window.
ssthresh : The current ssthresh value.
RTO : The current retransmission timeout value.
SRTT : The current smoothed round-trip time.
RTTVAR : The current RTT variation.
partial : The tracking method for increase of cwnd when in
bytes acked : congestion avoidance mode (see Section 7.2.2).
state : The current state of this destination, i.e., DOWN, UP,
: ALLOW-HB, NO-HEARTBEAT, etc.
PMTU : The current known path MTU.
Per : A timer used by each destination.
Destination :
Timer :
RTO-Pending : A flag used to track if one of the DATA chunks sent to
: this address is currently being used to compute an
: RTT. If this flag is 0, the next DATA chunk sent to
: this destination should be used to compute an RTT and
: this flag should be set. Every time the RTT
: calculation completes (i.e., the DATA chunk is SACK'd),
: clear this flag.
last-time : The time to which this destination was last sent.
: This can be to determine if a HEARTBEAT is needed.13.4. General Parameters Needed ✨
last one, and it's the easy one 🫶
Out Queue : A queue of outbound DATA chunks.
In Queue : A queue of inbound DATA chunks.14. IANA Considerations 🎀
IANA is the registry keeper here 👑 SCTP has three registries that IANA looks after:
- through definition of additional chunk types,
- through definition of additional parameter types, or
- through definition of additional cause codes within ERROR chunks.
ngl the port thing is important too: SCTP needs the IANA Port Numbers registry opened up for SCTP port registrations, and Section 14.5 explains how 🌈 there's also an IESG-appointed Expert Reviewer who helps IANA check SCTP port allocation requests 🧚
14.1. IETF-Defined Chunk Extension 💅
when you want a brand new chunk parameter type code, it goes through an IETF Consensus action (see [RFC2434]) 💜 your docs MUST have all of this:
- a) A long and short name for the new chunk type.
- b) A detailed description of the structure of the chunk, which MUST conform to the basic structure defined in Section 3.2.
- c) A detailed definition and description of intended use of each field within the chunk, including the chunk flags if any.
- d) A detailed procedural description of the use of the new chunk type within the operation of the protocol.
and the last chunk type (255) is kept in reserve for future extension if it's ever needed 🔮
14.2. IETF-Defined Chunk Parameter Extension 🌸
same vibe for new chunk parameter types: it's an IETF Consensus action as defined in [RFC2434] 🍓 your documentation MUST include all of these:
- a) Name of the parameter type.
- b) Detailed description of the structure of the parameter field. This structure MUST conform to the general Type-Length-Value format described in Section 3.2.1.
- c) Detailed definition of each component of the parameter value.
- d) Detailed description of the intended use of this parameter type, and an indication of whether and under what circumstances multiple instances of this parameter type may be found within the same chunk.
- e) Each parameter type MUST be unique across all chunks.
14.3. IETF-Defined Additional Error Causes 🙈
new cause codes can be handed out in the range 11 to 65535 through a Specification Required action (see [RFC2434]) ⭐ the paperwork has to cover:
- a) Name of the error condition.
- b) Detailed description of the conditions under which an SCTP endpoint should issue an ERROR (or ABORT) with this cause code.
- c) Expected action by the SCTP endpoint that receives an ERROR (or ABORT) chunk containing this cause code.
- d) Detailed description of the structure and content of data fields that accompany this cause code.
the first word (32 bits) of a cause code parameter MUST follow the format from Section 3.3.10, which means:
- first 2 bytes contain the cause code value
- last 2 bytes contain the length of the cause parameter.
14.4. Payload Protocol Identifiers 🧚♀️
okay so value 0 is the special one, reserved by SCTP to mean "unspecified payload protocol identifier" in a DATA chunk 🫠 other than that, SCTP isn't in charge of standardizing or verifying any payload protocol identifiers. it just takes whatever the upper layer hands it and carries it along with the payload 🎁
the upper layer (aka the SCTP user) SHOULD standardize any specific protocol identifier with IANA if they want to. using any specific payload protocol identifier is outside SCTP's scope, so that's on them, not SCTP 💖
14.5. Port Numbers Registry ✨
okay so SCTP services can use contact port numbers to serve unknown callers, just like TCP and UDP 🎀. IANA is being asked to open the existing Port Numbers registry for SCTP using the rules below, which are meant to mesh nicely with the existing Port Numbers registration procedures 💅. An IESG-appointed Expert Reviewer helps IANA evaluate SCTP port allocation requests, following the procedure in [RFC2434] 🧚.
Port numbers come in three ranges 🌈. The Well Known Ports are 0 through 1023, the Registered Ports are 1024 through 49151, and the Dynamic and/or Private Ports are 49152 through 65535. Well Known and Registered Ports are for server applications that want a default contact point on a system ✨. On most systems, Well Known Ports can only be used by system (or root) processes or by programs run by privileged users, while Registered Ports can be used by ordinary user processes or programs run by ordinary users 👑. Dynamic and/or Private Ports are for temporary stuff, like client-side ports, out-of-band negotiated ports, and application testing before a dedicated port is registered 🦋. They MUST NOT be registered, bestie, no exceptions 🙈.
The Port Numbers registry should accept registrations for SCTP ports in the Well Known and Registered Ranges 💜. Well Known and Registered Ports SHOULD NOT be used without registration. Now, I know it can seem natural to use an SCTP port before registration finishes, especially when you're porting an app from TCP to SCTP 🥺, but IANA will not guarantee registration of particular Well Known and Registered Ports, so ngl, request your registrations as early as possible 💀.
Each port registration SHALL include the following information:
- A short port name, made up entirely of letters (A-Z and a-z), digits (0-9), and punctuation characters from "-_+./*" (not including the quotes).
- The port number being requested for registration.
- A short English phrase describing the port's purpose.
- Name and contact information for the person or entity doing the registration, and possibly a reference to a document defining the port's use. Registrations from IETF working groups only need to name the working group, but listing a contact person is recommended 🫶.
Registrants are encouraged to follow these guidelines when submitting a registration 💅:
- A port name SHOULD NOT be registered for more than one SCTP port number.
- A port name registered for TCP MAY be registered for SCTP as well. Any such registration SHOULD use the same port number as the existing TCP registration 🍓.
- Concrete intent to use a port SHOULD precede port registration. For example, existing TCP ports SHOULD NOT be registered in advance of any intent to use those ports for SCTP 🙅♀️.
This document registers the following ports. (These registrations should be considered models to follow for future allocation requests 🌸.)
discard 9/sctp Discard # IETF TSVWG
# Randall Stewart <rrs@cisco.com>
# [RFC4960]The discard service accepts SCTP connections on port 9 and throws away all incoming application data without sending anything back 🗑️✨. So SCTP's discard port is basically the cousin of TCP's discard port, and it might be used to check the health of an SCTP stack 🩺.
ftp-data 20/sctp FTP # IETF TSVWG
# Randall Stewart <rrs@cisco.com>
# [RFC4960]
ftp 21/sctp FTP # IETF TSVWG
# Randall Stewart <rrs@cisco.com>
# [RFC4960]These are the File Transfer Protocol (FTP) data port (20) and control port (21) 📁💖.
ssh 22/sctp SSH # IETF TSVWG
# Randall Stewart <rrs@cisco.com>
# [RFC4960]This one is the Secure Shell (SSH) remote login service, which lets you do secure shell logins to a host 🔐🦋.
http 80/sctp HTTP # IETF TSVWG
# Randall Stewart <rrs@cisco.com>
# [RFC4960]This is World Wide Web HTTP over SCTP 🌐🌸.
bgp 179/sctp BGP # IETF TSVWG
# Randall Stewart <rrs@cisco.com>
# [RFC4960]And this is Border Gateway Protocol over SCTP 🛰️💜.
https 443/sctp HTTPS # IETF TSVWG
# Randall Stewart <rrs@cisco.com>
# [RFC4960]Last but not least, World Wide Web HTTP over TLS/SSL over SCTP 🔒👑.
15. Suggested SCTP Protocol Parameter Values 💖
okay so these are the protocol parameters that are RECOMMENDED 🎀:
RTO.Initial - 3 secondsRTO.Min - 1 secondRTO.Max - 60 secondsMax.Burst - 4RTO.Alpha - 1/8RTO.Beta - 1/4Valid.Cookie.Life - 60 secondsAssociation.Max.Retrans - 10 attemptsPath.Max.Retrans - 5 attempts (per destination address)Max.Init.Retransmits - 8 attemptsHB.interval - 30 secondsHB.Max.Burst - 1
IMPLEMENTATION NOTE: the SCTP implementation may let the ULP customize some of these protocol parameters (see Section 10) 🧁.
Note: RTO.Min SHOULD be set as recommended above 💅.
16. Acknowledgements 🫶
Honestly, the update to this document is not a small feat 😭. It represents the work of the initial authors of RFC 2960: Q. Xie, K. Morneault, C. Sharp, H. Schwarzbauer, T. Taylor, I. Rytina, M. Kalla, L. Zhang, and V. Paxson 🌟.
Then there are the comments from everyone who contributed to the original RFC: Mark Allman, R.J. Atkinson, Richard Band, Scott Bradner, Steve Bellovin, Peter Butler, Ram Dantu, R. Ezhirpavai, Mike Fisk, Sally Floyd, Atsushi Fukumoto, Matt Holdrege, Henry Houh, Christian Huitema, Gary Lehecka, Jonathan Lee, David Lehmann, John Loughney, Daniel Luan, Barry Nagelberg, Thomas Narten, Erik Nordmark, Lyndon Ong, Shyamal Prasad, Kelvin Porter, Heinz Prantner, Jarno Rajahalme, Raymond E. Reeves, Renee Revis, Ivan Arias Rodriguez, A. Sankar, Greg Sidebottom, Brian Wyld, La Monte Yarroll, and many others for their invaluable comments 💜.
Then add the authors of the SCTP implementor's guide: I. Arias-Rodriguez, K. Poon, A. Caro, and M. Tuexen 🦋.
Then add the efforts of all the subsequent seven SCTP interoperability tests, and those who commented on RFC 4460 as shown in its acknowledgements: Barry Zuckerman, La Monte Yarroll, Qiaobing Xie, Wang Xiaopeng, Jonathan Wood, Jeff Waskow, Mike Turner, John Townsend, Sabina Torrente, Cliff Thomas, Yuji Suzuki, Manoj Solanki, Sverre Slotte, Keyur Shah, Jan Rovins, Ben Robinson, Renee Revis, Ian Periam, RC Monee, Sanjay Rao, Sujith Radhakrishnan, Heinz Prantner, Biren Patel, Nathalie Mouellic, Mitch Miers, Bernward Meyknecht, Stan McClellan, Oliver Mayor, Tomas Orti Martin, Sandeep Mahajan, David Lehmann, Jonathan Lee, Philippe Langlois, Karl Knutson, Joe Keller, Gareth Keily, Andreas Jungmaier, Janardhan Iyengar, Mutsuya Irie, John Hebert, Kausar Hassan, Fred Hasle, Dan Harrison, Jon Grim, Laurent Glaude, Steven Furniss, Atsushi Fukumoto, Ken Fujita, Steve Dimig, Thomas Curran, Serkan Cil, Melissa Campbell, Peter Butler, Rob Brennan, Harsh Bhondwe, Brian Bidulock, Caitlin Bestler, Jon Berger, Robby Benedyk, Stephen Baucke, Sandeep Balani, and Ronnie Sellar 🌈.
A special thanks to Mark Allman, who should actually be a co-author for his work on the max-burst, but managed to wiggle out due to a technicality 😂. We'd also like to acknowledge Lyndon Ong and Phil Conrad for their valuable input and many contributions 👑.
And finally, there's you, this document, and everyone who has commented on it, including Alfred Hoenes and Ronnie Sellars 🎀.
My thanks cannot be adequately expressed to all of you who have participated in the coding, testing, and updating process of this document. All I can say is, Thank You! 💖
Randall Stewart - Editor ✨
Appendix A. Explicit Congestion Notification 🦋
ECN [RFC3168] describes a proposed extension to IP that gives a way to become aware of congestion outside of datagram loss 🌬️. It's an optional feature that an implementation MAY choose to add to SCTP 💅. This appendix covers the minor differences implementers need to know about if they go for it. In general, [RFC3168] should be followed, with the exceptions below 🧚.
Negotiation
[RFC3168] details negotiation of ECN during the SYN and SYN-ACK stages of a TCP connection. The sender of the SYN sets 2 bits in the TCP flags, and the sender of the SYN-ACK sets only 1 bit. The reasoning is to make sure both sides are truly ECN capable 🤔. For SCTP, this isn't necessary. To indicate that an endpoint is ECN capable, an endpoint SHOULD add the TLV reserved for ECN to the INIT and or INIT ACK chunk 🎀. This TLV contains no parameters, and so it has the following format:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Parameter Type = 32768 | Parameter Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ECN-Echo
[RFC3168] details a specific bit that a receiver sends back in its TCP acknowledgements to tell the sender that the Congestion Experienced (CE) bit has shown up from the network 📡. For SCTP, this same indication is made by including the ECNE chunk 🦋. This chunk contains one data element, the lowest TSN associated with the IP datagram marked with the CE bit, and it looks like this 👀:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Chunk Type=12 | Flags=00000000| Chunk Length = 8 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Lowest TSN Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Note: the ECNE is considered a Control chunk 🧾.
CWR
[RFC3168] details a specific bit that a sender puts in the header of its next outbound TCP segment to tell its peer that it has reduced its congestion window. This is called the CWR bit 🪟. For SCTP, the same indication is made by including the CWR chunk 💜. This chunk contains one data element, the TSN number that was sent in the ECNE chunk. That element is the lowest TSN number in the datagram that was originally marked with the CE bit 🌸.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Chunk Type=13 | Flags=00000000| Chunk Length = 8 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Lowest TSN Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Note: the CWR is considered a Control chunk 🫶.
Appendix B. CRC32c Checksum Calculation 🦋
okay so first things first, we call a 'reflected value' 🪞 one that's the opposite of the machine's normal bit order. bestie, this is the foundation of the whole CRC32c thing ✨. The 32-bit CRC (Cyclic Redundancy Check) is worked out the CRC32c way, and it uses the polynomial code 0x11EDC6F41 (Castagnoli93) 💅. Written out as powers of x, it's:
x^32+x^28+x^27+x^26+x^25
+x^23+x^22+x^20+x^19+x^18+ x^14+x^13+x^11+x^10+x^9+x^8+x^6+x^0The whole calc is kinda like the ETHERNET CRC [ITU32] 🧚, just tweaked so it fits transport-level usage. It's giving "same vibe, new outfit" 🎀.
CRC computation is all about polynomial division 🧮. A message bit-string M gets turned into a polynomial, M(X), and then the CRC is calculated from M(X) using polynomial arithmetic. ngl it sounds scarier than it is 🙈.
When CRCs are used at the link layer, the polynomial comes from the on-the-wire bit ordering: the first bit 'on the wire' is the high-order coefficient. But SCTP is a transport-level protocol 🌸, so it can't know the actual serial-media bit ordering. Plus, different links in the path between SCTP endpoints might use different link-level bit orders. Not me, the chaos 💀.
So we need a convention for mapping SCTP transport messages to polynomials for CRC computation 🫶. Here's the move: bytes are taken most-significant first, but within each byte, bits are taken least-significant first. The first byte of the message gives the eight highest coefficients. Inside each byte, the least-significant SCTP bit gives the most-significant polynomial coefficient in that byte, and the most-significant SCTP bit is the least-significant polynomial coefficient in that byte. (This bit ordering is sometimes called 'mirrored' or 'reflected' [WILLIAMS93] 🪞✨.) CRC polynomials are to be transformed back into SCTP transport-level byte values, using a consistent mapping 🔁.
The SCTP transport-level CRC value should be calculated as follows:
- CRC input data are assigned to a byte stream, numbered from
0toN-1📚. - The transport-level byte stream is mapped to a polynomial value. An N-byte PDU with j bytes numbered
0toN-1is considered as coefficients of a polynomialM(x)of order8N-1, with bit 0 of byte j being coefficientx^(8(N-j)-8), and bit 7 of byte j being coefficientx^(8(N-j)-1)🧠💖. - The CRC remainder register is initialized with all 1s, and the CRC is computed with an algorithm that simultaneously multiplies by
x^32and divides by the CRC polynomial 🌈. - The polynomial is multiplied by
x^32and divided byG(x), the generator polynomial, producing a remainderR(x)of degree less than or equal to31👑. - The coefficients of
R(x)are considered a 32-bit sequence 🎀. - The bit sequence is complemented. The result is the CRC polynomial 💜.
- The CRC polynomial is mapped back into SCTP transport-level bytes. The coefficient of
x^31gives the value of bit 7 of SCTP byte 0, and the coefficient ofx^24gives the value of bit 0 of byte 0. The coefficient ofx^7gives bit 7 of byte 3, and the coefficient ofx^0gives bit 0 of byte 3. The resulting 4-byte transport-level sequence is the 32-bit SCTP checksum value 🦋🔥.
IMPLEMENTATION NOTE 📝: Standards documents, textbooks, and vendor literature on CRCs often follow an alternative formulation, in which the register used to hold the remainder of the long-division algorithm is initialized to zero rather than all-1s, and instead the first 32 bits of the message are complemented. The long-division algorithm used in our formulation is specified such that the initial multiplication by 2^32 and the long-division are combined into one simultaneous operation. For such algorithms, and for messages longer than 64 bits, the two specifications are precisely equivalent. That equivalence is the intent of this document 🫶.
Implementors of SCTP are warned that both specifications are to be found in the literature, sometimes with no restriction on the long-division algorithm 😭. The choice of formulation in this document is to permit non-SCTP usage, where the same CRC algorithm may be used to protect messages shorter than 64 bits 🌸.
There may be a computational advantage in validating the association against the Verification Tag, prior to performing a checksum, as invalid tags will result in the same action as a bad checksum in most cases ✨. The exceptions for this technique would be INIT and some SHUTDOWN-COMPLETE exchanges, as well as a stale COOKIE ECHO. These special-case exchanges must represent small packets and will minimize the effect of the checksum calculation 💅🍓.
Appendix C. ICMP Handling ✨
Okay so, whenever an ICMP message lands on an SCTP endpoint, the following procedures MUST be followed 💅 Layer 3 is handing you info, and you need to use it properly, bestie 🫶
- ICMP1) You MAY ignore all ICMPv4 messages where the type field is not set to "Destination Unreachable" 🙈
- ICMP2) You MAY ignore all ICMPv6 messages where the type field is not "Destination Unreachable", "Parameter Problem",, or "Packet Too Big" 🌸
- ICMP3) You MAY ignore any ICMPv4 messages where the code does not indicate "Protocol Unreachable" or "Fragmentation Needed" 🦋
- ICMP4) You MAY ignore all ICMPv6 messages of type "Parameter Problem" if the code is not "Unrecognized Next Header Type Encountered" 🧚
- ICMP5) You MUST use the payload of the ICMP message (v4 or v6) to find the association that sent the message ICMP is responding to. If the association can't be found, you SHOULD ignore the ICMP message 🔍
- ICMP6) You MUST check that the Verification Tag in the ICMP message matches the Verification Tag of the peer. If the Verification Tag is not 0 and does NOT match, discard the ICMP message 🚫 If it IS 0, and the ICMP message has enough bytes to confirm that the chunk type is an INIT chunk and that the Initiate Tag matches the peer's tag, keep going with ICMP7. If the ICMP message is too short, or the chunk type or the Initiate Tag doesn't match, silently discard the packet 🤫
- ICMP7) If the ICMP message is either a v6 "Packet Too Big" or a v4 "Fragmentation Needed", you MAY process this information as defined for PATH MTU discovery 📏
- ICMP8) If the ICMP code is an "Unrecognized Next Header Type Encountered" or a "Protocol Unreachable", you MUST treat this message as an abort with the T bit set, if it does not contain an INIT chunk. If it does contain an INIT chunk and the association is in the COOKIE-WAIT state, handle the ICMP message like an ABORT 💀
- ICMP9) If the ICMPv6 code is "Destination Unreachable", you MAY mark the destination as unreachable, or alternatively increment the path error counter 📉
Heads up, bestie: these procedures are different from [RFC1122] and from its requirements for processing port-unreachable messages. It also says an implementation MUST abort associations in response to a "protocol unreachable" message. Port-unreachable messages aren't processed, since an implementation will send an ABORT, not a port unreachable. The stricter handling of the "protocol unreachable" message is because of security concerns for hosts that do NOT support SCTP 😭🔒
The next bit is non-normative sample code 🧁 It's taken from an open-source CRC generator [WILLIAMS93], and it uses the "mirroring" technique to produce a lookup table for SCTP CRC32c with 256 entries, each 32 bits wide. It's not especially slow and not especially fast, as software table-lookup CRCs go. The real flex is that it works on both big-endian and little-endian CPUs, using the same (host-order) lookup tables, and it only uses the predefined ntohl() and htonl() operations 👑 The code was tweaked a bit from [WILLIAMS93] so it stays portable between big-endian and little-endian architectures. (Quick note: if the target architecture is known to be little-endian, the final bit-reversal and byte-reversal steps can be folded into a single operation.)
Here's the header with the table and the notes about the generator settings 🎀
/*************************************************************/
/* Note Definition for Ross Williams table generator would */
/* be: TB_WIDTH=4, TB_POLLY=0x1EDC6F41, TB_REVER=TRUE */
/* For Mr. Williams direct calculation code use the settings */
/* cm_width=32, cm_poly=0x1EDC6F41, cm_init=0xFFFFFFFF, */
/* cm_refin=TRUE, cm_refot=TRUE, cm_xorort=0x00000000 */
/*************************************************************/
/* Example of the crc table file */
#ifndef __crc32cr_table_h__
#define __crc32cr_table_h__
#define CRC32C_POLY 0x1EDC6F41
#define CRC32C(c,d) (c=(c>>8)^crc_c[(c^(d))&0xFF])
unsigned long crc_c[256] =
{
0x00000000L, 0xF26B8303L, 0xE13B70F7L, 0x1350F3F4L,
0xC79A971FL, 0x35F1141CL, 0x26A1E7E8L, 0xD4CA64EBL,
0x8AD958CFL, 0x78B2DBCCL, 0x6BE22838L, 0x9989AB3BL,
0x4D43CFD0L, 0xBF284CD3L, 0xAC78BF27L, 0x5E133C24L,
0x105EC76FL, 0xE235446CL, 0xF165B798L, 0x030E349BL,
0xD7C45070L, 0x25AFD373L, 0x36FF2087L, 0xC494A384L,
0x9A879FA0L, 0x68EC1CA3L, 0x7BBCEF57L, 0x89D76C54L,
0x5D1D08BFL, 0xAF768BBCL, 0xBC267848L, 0x4E4DFB4BL,
0x20BD8EDEL, 0xD2D60DDDL, 0xC186FE29L, 0x33ED7D2AL,
0xE72719C1L, 0x154C9AC2L, 0x061C6936L, 0xF477EA35L,
0xAA64D611L, 0x580F5512L, 0x4B5FA6E6L, 0xB93425E5L,
0x6DFE410EL, 0x9F95C20DL, 0x8CC531F9L, 0x7EAEB2FAL,
0x30E349B1L, 0xC288CAB2L, 0xD1D83946L, 0x23B3BA45L,
0xF779DEAEL, 0x05125DADL, 0x1642AE59L, 0xE4292D5AL,
0xBA3A117EL, 0x4851927DL, 0x5B016189L, 0xA96AE28AL,
0x7DA08661L, 0x8FCB0562L, 0x9C9BF696L, 0x6EF07595L,
0x417B1DBCL, 0xB3109EBFL, 0xA0406D4BL, 0x522BEE48L,
0x86E18AA3L, 0x748A09A0L, 0x67DAFA54L, 0x95B17957L,
0xCBA24573L, 0x39C9C670L, 0x2A993584L, 0xD8F2B687L,
0x0C38D26CL, 0xFE53516FL, 0xED03A29BL, 0x1F682198L,
0x5125DAD3L, 0xA34E59D0L, 0xB01EAA24L, 0x42752927L,
0x96BF4DCCL, 0x64D4CECFL, 0x77843D3BL, 0x85EFBE38L,
0xDBFC821CL, 0x2997011FL, 0x3AC7F2EBL, 0xC8AC71E8L,
0x1C661503L, 0xEE0D9600L, 0xFD5D65F4L, 0x0F36E6F7L,
0x61C69362L, 0x93AD1061L, 0x80FDE395L, 0x72966096L,
0xA65C047DL, 0x5437877EL, 0x4767748AL, 0xB50CF789L,
0xEB1FCBADL, 0x197448AEL, 0x0A24BB5AL, 0xF84F3859L,
0x2C855CB2L, 0xDEEEDFB1L, 0xCDBE2C45L, 0x3FD5AF46L,
0x7198540DL, 0x83F3D70EL, 0x90A324FAL, 0x62C8A7F9L,
0xB602C312L, 0x44694011L, 0x5739B3E5L, 0xA55230E6L,
0xFB410CC2L, 0x092A8FC1L, 0x1A7A7C35L, 0xE811FF36L,
0x3CDB9BDDL, 0xCEB018DEL, 0xDDE0EB2AL, 0x2F8B6829L,
0x82F63B78L, 0x709DB87BL, 0x63CD4B8FL, 0x91A6C88CL,
0x456CAC67L, 0xB7072F64L, 0xA457DC90L, 0x563C5F93L,
0x082F63B7L, 0xFA44E0B4L, 0xE9141340L, 0x1B7F9043L,
0xCFB5F4A8L, 0x3DDE77ABL, 0x2E8E845FL, 0xDCE5075CL,
0x92A8FC17L, 0x60C37F14L, 0x73938CE0L, 0x81F80FE3L,
0x55326B08L, 0xA759E80BL, 0xB4091BFFL, 0x466298FCL,
0x1871A4D8L, 0xEA1A27DBL, 0xF94AD42FL, 0x0B21572CL,
0xDFEB33C7L, 0x2D80B0C4L, 0x3ED04330L, 0xCCBBC033L,
0xA24BB5A6L, 0x502036A5L, 0x4370C551L, 0xB11B4652L,
0x65D122B9L, 0x97BAA1BAL, 0x84EA524EL, 0x7681D14DL,
0x2892ED69L, 0xDAF96E6AL, 0xC9A99D9EL, 0x3BC21E9DL,
0xEF087A76L, 0x1D63F975L, 0x0E330A81L, 0xFC588982L,
0xB21572C9L, 0x407EF1CAL, 0x532E023EL, 0xA145813DL,
0x758FE5D6L, 0x87E466D5L, 0x94B49521L, 0x66DF1622L,
0x38CC2A06L, 0xCAA7A905L, 0xD9F75AF1L, 0x2B9CD9F2L,
0xFF56BD19L, 0x0D3D3E1AL, 0x1E6DCDEEL, 0xEC064EEDL,
0xC38D26C4L, 0x31E6A5C7L, 0x22B65633L, 0xD0DDD530L,
0x0417B1DBL, 0xF67C32D8L, 0xE52CC12CL, 0x1747422FL,
0x49547E0BL, 0xBB3FFD08L, 0xA86F0EFCL, 0x5A048DFFL,
0x8ECEE914L, 0x7CA56A17L, 0x6FF599E3L, 0x9D9E1AE0L,
0xD3D3E1ABL, 0x21B862A8L, 0x32E8915CL, 0xC083125FL,
0x144976B4L, 0xE622F5B7L, 0xF5720643L, 0x07198540L,
0x590AB964L, 0xAB613A67L, 0xB831C993L, 0x4A5A4A90L,
0x9E902E7BL, 0x6CFBAD78L, 0x7FAB5E8CL, 0x8DC0DD8FL,
0xE330A81AL, 0x115B2B19L, 0x020BD8EDL, 0xF0605BEEL,
0x24AA3F05L, 0xD6C1BC06L, 0xC5914FF2L, 0x37FACCF1L,
0x69E9F0D5L, 0x9B8273D6L, 0x88D28022L, 0x7AB90321L,
0xAE7367CAL, 0x5C18E4C9L, 0x4F48173DL, 0xBD23943EL,
0xF36E6F75L, 0x0105EC76L, 0x12551F82L, 0xE03E9C81L,
0x34F4F86AL, 0xC69F7B69L, 0xD5CF889DL, 0x27A40B9EL,
0x79B737BAL, 0x8BDCB4B9L, 0x988C474DL, 0x6AE7C44EL,
0xBE2DA0A5L, 0x4C4623A6L, 0x5F16D052L, 0xAD7D5351L,
};
#endif
/* Example of table build routine */
#include <stdio.h>
#include <stdlib.h>
#define OUTPUT_FILE "crc32cr.h"
#define CRC32C_POLY 0x1EDC6F41L
FILE *tf;
unsigned long
reflect_32 (unsigned long b)
{
int i;
unsigned long rw = 0L;
for (i = 0; i < 32; i++){
if (b & 1)
rw |= 1 << (31 - i);
b >>= 1;
}
return (rw);
}
unsigned long
build_crc_table (int index)
{
int i;
unsigned long rb;
rb = reflect_32 (index);
for (i = 0; i < 8; i++){
if (rb & 0x80000000L)
rb = (rb << 1) ^ CRC32C_POLY;
else
rb <<= 1;
}
return (reflect_32 (rb));
}
main ()
{
int i;
printf ("\nGenerating CRC-32c table file <%s>\n",
OUTPUT_FILE);
if ((tf = fopen (OUTPUT_FILE, "w")) == NULL){
printf ("Unable to open %s\n", OUTPUT_FILE);
exit (1);
}
fprintf (tf, "#ifndef __crc32cr_table_h__\n");
fprintf (tf, "#define __crc32cr_table_h__\n\n");
fprintf (tf, "#define CRC32C_POLY 0x%08lX\n",
CRC32C_POLY);
fprintf (tf,
"#define CRC32C(c,d) (c=(c>>8)^crc_c[(c^(d))&0xFF])\n");
fprintf (tf, "\nunsigned long crc_c[256] =\n{\n");
for (i = 0; i < 256; i++){
fprintf (tf, "0x%08lXL, ", build_crc_table (i));
if ((i & 3) == 3)
fprintf (tf, "\n");
}
fprintf (tf, "};\n\n#endif\n");
if (fclose (tf) != 0)
printf ("Unable to close <%s>." OUTPUT_FILE);
else
printf ("\nThe CRC-32c table has been written to <%s>.\n",
OUTPUT_FILE);
}
/* Example of crc insertion */
#include "crc32cr.h"
unsigned long
generate_crc32c(unsigned char *buffer, unsigned int length)
{
unsigned int i;
unsigned long crc32 = ~0L;
unsigned long result;
unsigned char byte0,byte1,byte2,byte3;
for (i = 0; i < length; i++){
CRC32C(crc32, buffer[i]);
}
result = ~crc32;
/* result now holds the negated polynomial remainder;
* since the table and algorithm is "reflected" [williams95].
* That is, result has the same value as if we mapped the message
* to a polynomial, computed the host-bit-order polynomial
* remainder, performed final negation, then did an end-for-end
* bit-reversal.
* Note that a 32-bit bit-reversal is identical to four inplace
* 8-bit reversals followed by an end-for-end byteswap.
* In other words, the bytes of each bit are in the right order,
* but the bytes have been byteswapped. So we now do an explicit
* byteswap. On a little-endian machine, this byteswap and
* the final ntohl cancel out and could be elided.
*/
byte0 = result & 0xff;
byte1 = (result>>8) & 0xff;
byte2 = (result>>16) & 0xff;
byte3 = (result>>24) & 0xff;
crc32 = ((byte0 << 24) |
(byte1 << 16) |
(byte2 << 8) |
byte3);
return ( crc32 );
}
int
insert_crc32(unsigned char *buffer, unsigned int length)
{
SCTP_message *message;
unsigned long crc32;
message = (SCTP_message *) buffer;
message->common_header.checksum = 0L;
crc32 = generate_crc32c(buffer,length);
/* and insert it into the message */
message->common_header.checksum = htonl(crc32);
return 1;
}
int
validate_crc32(unsigned char *buffer, unsigned int length)
{
SCTP_message *message;
unsigned int i;
unsigned long original_crc32;
unsigned long crc32 = ~0L;
/* save and zero checksum */
message = (SCTP_message *) buffer;
original_crc32 = ntohl(message->common_header.checksum);
message->common_header.checksum = 0L;
crc32 = generate_crc32c(buffer,length);
return ((original_crc32 == crc32)? 1 : -1);
}References 📚
Normative References 📚✨
okay bestie, these are the docs the spec leans on so hard it literally can't stand without them 💅
- [ITU32] "ITU-T Recommendation V.42, "Error-correcting procedures for DCEs using asynchronous-to-synchronous conversion".", ITU-T section 8.1.1.6.2.
- [RFC0768] Postel, J., "User Datagram Protocol", STD 6, RFC 768, August 1980.
- [RFC0793] Postel, J., "Transmission Control Protocol", STD 7, RFC 793, September 1981.
- [RFC1122] Braden, R., Ed., "Requirements for Internet Hosts - Communication Layers", STD 3, RFC 1122, October 1989.
- [RFC1123] Braden, R., Ed., "Requirements for Internet Hosts - Application and Support", STD 3, RFC 1123, October 1989.
- [RFC1191] Mogul, J. and S. Deering, "Path MTU discovery", RFC 1191, November 1990.
- [RFC1981] McCann, J., Deering, S., and J. Mogul, "Path MTU Discovery for IP version 6", RFC 1981, August 1996.
- [RFC1982] Elz, R. and R. Bush, "Serial Number Arithmetic", RFC 1982, August 1996.
- [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
- [RFC2434] Narten, T. and H. Alvestrand, "Guidelines for Writing an IANA Considerations Section in RFCs", BCP 26, RFC 2434, October 1998.
- [RFC2460] Deering, S. and R. Hinden, "Internet Protocol, Version 6 (IPv6) Specification", RFC 2460, December 1998.
- [RFC2581] Allman, M., Paxson, V., and W. Stevens, "TCP Congestion Control", RFC 2581, April 1999.
- [RFC3873] Pastor, J. and M. Belinchon, "Stream Control Transmission Protocol (SCTP) Management Information Base (MIB)", RFC 3873, September 2004.
- [RFC4291] Hinden, R. and S. Deering, "IP Version 6 Addressing Architecture", RFC 4291, February 2006.
- [RFC4301] Kent, S. and K. Seo, "Security Architecture for the Internet Protocol", RFC 4301, December 2005.
- [RFC4303] Kent, S., "IP Encapsulating Security Payload (ESP)", RFC 4303, December 2005.
- [RFC4306] Kaufman, C., Ed., "Internet Key Exchange (IKEv2) Protocol", RFC 4306, December 2005.
- [RFC4821] Mathis, M. and J. Heffner, "Packetization Layer Path MTU Discovery", RFC 4821, March 2007.
Informative References 🧠🫶
these ones are the extra credit reads, the research and history that's giving "wow, she really did her homework" 🎀
- [FALL96] Fall, K. and S. Floyd, "Simulation-based Comparisons of Tahoe, Reno, and SACK TCP", SIGCOMM'99 V. 26 N. 3 pp 5-21, July 1996.
- [SAVAGE99] Savage, S., Cardwell, N., Wetherall, D., and T. Anderson, "TCP Congestion Control with a Misbehaving Receiver", ACM Computer Communications Review 29(5), October 1999.
- [ALLMAN99] Allman, M. and V. Paxson, "On Estimating End-to-End Network Path Properties", SIGCOMM'99, 1999.
- [WILLIAMS93] Williams, R., "A PAINLESS GUIDE TO CRC ERROR DETECTION ALGORITHMS", Internet publication,
http://www.geocities.com/SiliconValley/Pines/8659/crc.htm, August 1993. - [RFC0813] Clark, D., "Window and Acknowledgement Strategy in TCP", RFC 813, July 1982.
- [RFC1858] Ziemba, G., Reed, D., and P. Traina, "Security Considerations for IP Fragment Filtering", RFC 1858, October 1995.
- [RFC2104] Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed-Hashing for Message Authentication", RFC 2104, February 1997.
- [RFC2196] Fraser, B., "Site Security Handbook", FYI 8, RFC 2196, September 1997.
- [RFC2522] Karn, P. and W. Simpson, "Photuris: Session-Key Management Protocol", RFC 2522, March 1999.
- [RFC2960] Stewart, R., Xie, Q., Morneault, K., Sharp, C., Schwarzbauer, H., Taylor, T., Rytina, I., Kalla, M., Zhang, L., and V. Paxson, "Stream Control Transmission Protocol", RFC 2960, October 2000.
- [RFC3309] Stone, J., Stewart, R., and D. Otis, "Stream Control Transmission Protocol (SCTP) Checksum Change", RFC 3309, September 2002.
- [RFC3168] Ramakrishnan, K., Floyd, S., and D. Black, "The Addition of Explicit Congestion Notification (ECN) to IP", RFC 3168, September 2001.
- [RFC4086] Eastlake, D., 3rd, Schiller, J., and S. Crocker, "Randomness Requirements for Security", BCP 106, RFC 4086, June 2005.
- [RFC4460] Stewart, R., Arias-Rodriguez, I., Poon, K., Caro, A., and M. Tuexen, "Stream Control Transmission Protocol (SCTP) Specification Errata and Issues", RFC 4460, April 2006.
- [RFC4895] Tuexen, M., Stewart, R., Lei, P., and E. Rescorla, "Authenticated Chunks for Stream Control Transmission Protocol (SCTP)", RFC 4895, August 2007.
Editor's Address 💌
here's where to find the editor, Randall R. Stewart 🦋
Randall R. Stewart
4875 Forest Drive
Suite 200
Columbia, SC 29206
US
EMail: rrs@cisco.comFull Copyright Statement ⚖️
the legal bit, and yes I'm keeping it word for word because it matters 🙈
Copyright (C) The IETF Trust (2007).
This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.
This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property 🔐
the IETF's rights and licensing notes, so you know where to look if you need them 🌈
The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org.
📦 where this page comes from
- ietf: rfc4960 2007-09
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms