RFC 5357
A Two-Way Active Measurement Protocol (TWAMP)
RFC 5357: A Two-Way Active Measurement Protocol (TWAMP) 🦋
Category: Standards Track ✨ Date: October 2008 📅 Authors: K. Hedayat (Brix Networks), R. Krzanowski (Verizon), A. Morton (AT&T Labs), K. Yum (Juniper Networks), and J. Babiarz (Nortel Networks) 👑 Obsoletes/Updates: The title block doesn't list any Obsoletes or Updates, so this one doesn't replace or update anything 🌸
Status of This Memo 📝
Okay so this document is an Internet standards track protocol spec for the Internet community, and it's basically asking everyone for discussion and suggestions 🗣️ For the official standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1) 📚 Distribution of this memo is unlimited, so everyone can read it 💜
Abstract 🌈
Okay, so the One-way Active Measurement Protocol (OWAMP) is in RFC 4656, and it gives you a shared way to measure one-way metrics between network devices 💖 You can even use OWAMP bi-directionally, which measures one-way metrics in both directions between two network elements ✨ The catch? It doesn't handle round-trip or two-way measurements at all 💀
So this memo introduces the Two-Way Active Measurement Protocol (TWAMP), which is built on OWAMP and adds two-way or round-trip measurement abilities 🦋 TWAMP's architecture usually has two hosts, each with a specific role, and that means it can skip some steps, which makes it a seriously attractive option in certain situations 🔥
Table of Contents 🎀
1. Introduction ....................................................2
1.1. Relationship of Test and Control Protocols .................3
1.2. Logical Model ..............................................3
1.3. Pronunciation Guide ........................................4
2. Protocol Overview ...............................................5
3. TWAMP-Control ...................................................6
3.1. Connection Setup ...........................................6
3.2. Integrity Protection .......................................7
3.3. Values of the Accept Field .................................7
3.4. TWAMP-Control Commands .....................................7
3.5. Creating Test Sessions .....................................8
3.6. Send Schedules ............................................10
3.7. Starting Test Sessions ....................................10
3.8. Stop-Sessions .............................................10
3.9. Fetch-Session .............................................12
4. TWAMP-Test .....................................................12
4.1. Sender Behavior ...........................................12
4.1.1. Packet Timings .....................................12
4.1.2. Packet Format and Content ..........................12
4.2. Reflector Behavior ........................................13
4.2.1. TWAMP-Test Packet Format and Content ...............14
5. Implementers' Guide ............................................20
6. Security Considerations ........................................20
7. Acknowledgements ...............................................21
8. IANA Considerations ............................................21
8.1. Registry Specification ....................................22
8.2. Registry Management .......................................22
8.3. Experimental Numbers ......................................22
8.4. Initial Registry Contents .................................22
9. Internationalization Considerations ............................22
Appendix I - TWAMP Light (Informative) ............................23
Normative References ..............................................24
Informative References ............................................241. Introduction ✨
Okay so the IETF finished a Proposed Standard for the round-trip delay [RFC2681] metric 🎀 It also finished a protocol for controlling and collecting one-way measurements, which is OWAMP [RFC4656] 💅 But OWAMP can't do round-trip or two-way measurements, sadly 😭
Two-way measurements are super common in IP networks, mostly because round-trip delay doesn't need local and remote clocks to be synchronized 🕰️ Plus, the remote end might only need a simple echo function for support 🫶 The most popular round-trip tool is ICMP Echo Request/Reply (the one ping uses), and the problems with it are written up in Section 2.6 of [RFC2681] 🙈 Enter TWAMP! 🧚 It uses the methodology and architecture of OWAMP [RFC4656] to define an open protocol for measuring two-way or round-trip metrics. In this document, "two-way" also means round-trip, and TWAMP keeps all the one-way metrics that OWAMP already has 🌸 TWAMP also puts timestamps on at the echo destination (the reflector), so you get more accuracy because processing delays can be accounted for 🔥 Its architecture usually has only two hosts with specific roles, which allows some simplifications and makes it an attractive alternative to OWAMP in some circumstances 👑
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119] 📖
1.1. Relationship of Test and Control Protocols 🧩
Just like OWAMP [RFC4656], TWAMP is made of two inter-related protocols: TWAMP-Control and TWAMP-Test 💜 The relationship between them is defined in Section 1.1 of OWAMP [RFC4656] 💖 TWAMP-Control is what starts, stops, and initiates test sessions, while TWAMP-Test is what swaps test packets between two TWAMP entities 🦋
1.2. Logical Model 🌈
The roles and definitions of the logical entities are the same as in Section 1.2 of OWAMP [RFC4656], with a few exceptions 💅
- The Session-Receiver is called the Session-Reflector in TWAMP 🪞 The Session-Reflector can create and send a measurement packet when it gets one. Unlike the Session-Receiver, it doesn't collect any packet information 🙅♀️
- The Server is an end system that manages one or more TWAMP sessions, and it can configure per-session state in the endpoints ✨ But a Server linked to a Session-Reflector wouldn't be able to return the results of a test session, and that's a difference from OWAMP 😭
- The Fetch-Client doesn't exist in TWAMP, because the Session-Reflector doesn't collect any packet information to fetch 💀 So there's no need for a Fetch-Client at all 🫠
Here's an example of how these roles can relate to each other. Different logical roles are played on different hosts here 🎀 Unlabeled links in the figure aren't specified by this document, so they could be proprietary protocols 🤷♀️
+----------------+ +-------------------+
| Session-Sender |<-TWAMP-Test-->| Session-Reflector |
+----------------+ +-------------------+
^ ^
| |
| |
| |
| +----------------+<----------------+
| | Server |
| +----------------+
| ^
| |
| TWAMP-Control
| |
v v
+----------------+
| Control-Client |
+----------------+As in OWAMP [RFC4656], one host can play more than one logical role 🧚 In the figure above, there could be two hosts instead: one playing Control-Client and Session-Sender, and the other playing Server and Session-Reflector 🍓 Here's that setup:
+-----------------+ +-------------------+
| Control-Client |<--TWAMP-Control-->| Server |
| | | |
| Session-Sender |<--TWAMP-Test----->| Session-Reflector |
+-----------------+ +-------------------+1.3. Pronunciation Guide 🗣️
OWAMP is usually pronounced in two syllables: Oh-wamp 💖
TWAMP is also pronounced in two syllables: Tee-wamp 💜
2. Protocol Overview 🌸
The Two-Way Active Measurement Protocol is an open protocol for measuring two-way metrics 🦋 It's based on OWAMP [RFC4656] and sticks to OWAMP's overall architecture and design 💅 TWAMP-Control and TWAMP-Test do their testing in these steps:
- The Control-Client starts a TCP connection on TWAMP's well-known port 🔌 Then the Server (now that its role is set) replies with its Greeting message, which says which security/integrity mode(s) it's willing to support 👋
- The Control-Client answers with the mode it picked, along with the information needed for integrity protection and encryption if that mode requires them 🔐 The Server replies to accept the mode and gives its start time 🕰️ That finishes the control-connection setup ✨
- The Control-Client asks for (and describes) a test session using a unique TWAMP-Control message 📝 The Server answers with its acceptance and supporting info 🫶 You can request more than one test session with extra messages 🔥
- The Control-Client kicks off all the requested testing with a Start-Sessions message, and the Server acknowledges it 🚀
- The Session-Sender and the Session-Reflector swap test packets according to the TWAMP-Test protocol for each active session 💫
- When it's time, the Control-Client sends a message to stop all test sessions 🛑
TWAMP has two recognized extension mechanisms, and they're the bestie-approved way to add stuff later 🧩
- The Modes field sets up the communication options during TWAMP-Control Connection Setup 🎀
- The TWAMP-Control Command Number is another intended extension mechanism, so extra commands can be defined in the future 🔮
The TWAMP-Control protocol sorts out different capability levels between the Control-Client and the Server 👑
All multi-octet quantities in this document are represented as unsigned integers in network byte order, unless it says otherwise 🔢
Throughout this memo, the bits marked MBZ (Must Be Zero) MUST be set to zero by senders and MUST be ignored by receivers 🙈
3. TWAMP-Control 🎛️
TWAMP-Control is a derivative of OWAMP-Control for two-way measurements 🌈 All TWAMP-Control messages look pretty similar in format and follow guidelines similar to those in Section 3 of OWAMP [RFC4656], with the exceptions listed in the following sections 💅 One big exception is the Fetch-Session command, which TWAMP doesn't use at all 💀
3.1. Connection Setup 💖
Okay so connection setup for TWAMP is giving the same energy as OWAMP, bestie 🎀 It follows the exact same procedure from Section 3.1 of OWAMP [RFC4656]. The Modes field is a recognized extension mechanism in TWAMP, and the current mode values are identical to the ones OWAMP uses. The only plot twist is the well-known port number for TWAMP-Control. A Client opens a TCP connection to the Server on well-known port 862 🦋 The host that starts the TCP connection takes on the Control-Client role and, in the two-host implementation, the Session-Sender role too. The host that acknowledges the TCP connection becomes the Server and, in the two-host implementation, the Session-Reflector. 🌸
The Control-Client MAY set a desired code point in the Diffserv Code Point (DSCP) field in the IP header for ALL packets of a specific control connection. ✨ Then the Server SHOULD use the DSCP of the Control-Client's TCP SYN in ALL subsequent packets on that connection, which avoids any ambiguity in case of re-marking. Iconic behavior 💅
Now the failure stuff, which is kind of scary but very important 😭 The Control-Client could fail after the TWAMP-Control connection is set up, or the path between the Control-Client and Server could fail while a connection is in progress. The Server MAY discontinue any established control connection when no packet associated with that connection has been received within SERVWAIT seconds. The Server SHALL suspend monitoring control connection activity after receiving a Start-Sessions command, and SHALL resume after receiving a Stop-Sessions command (IF the SERVWAIT option is supported).
TheREFWAITtimeout (described below) covers failures during test sessions. IfREFWAITexpires on ALL test sessions initiated by a TWAMP-Control connection, then theSERVWAITmonitoring SHALL resume, as though aStop-Sessionscommand had been received. 🙈
An implementation that supports the SERVWAIT timeout SHOULD also implement the REFWAIT timeout. The default value of SERVWAIT SHALL be 900 seconds, and this waiting time MAY be configurable. This timeout lets the Server free up resources in case of failure, which is honestly a very responsible move 🫶
Next up, secrets and passphrases 🔐 Both the Server and the Client use the same mappings from KeyIDs to shared secrets. The Server is prepared to run sessions with more than one Client, so it uses KeyIDs to pick the right secret key. A Client would typically have different secret keys for different Servers. The shared secret is a passphrase. To maximize passphrase interoperability, the passphrase character set MUST be encoded using Appendix B of [RFC5198] (the ASCII Network Virtual Terminal Definition). It MUST not contain newlines (any combination of Carriage-Return (CR) and/or Line-Feed (LF) characters), and control characters SHOULD be avoided. No newlines, no drama 🍓
3.2. Integrity Protection 🛡️
Integrity protection in TWAMP follows the same procedure defined in Section 3.2 of OWAMP [RFC4656]. As in OWAMP, each HMAC (Hashed Message Authentication Code) sent covers everything sent in a given direction between the previous HMAC (but not including it) and the start of the new HMAC. This way, once encryption is set up, each bit of the TWAMP-Control connection is authenticated by an HMAC exactly once. Literally every bit gets checked, which is so thorough 😤
Here's the tea: the Server-Start message, which the Server sends during the initial control-connection exchanges, does not end with an HMAC field. So the HMAC in the first Accept-Session message also covers the Server-Start message, and it includes the Start-Time field in the HMAC calculation. Main character energy 👑
Also, in authenticated and encrypted modes, the HMAC in TWAMP-Control packets is encrypted. Hidden and protected 🔒
3.3. Values of the Accept Field 🎯
The Accept values used in TWAMP are the same as the values defined in Section 3.3 of OWAMP [RFC4656]. Nothing new here, just a clean hand-me-down 🌈
3.4. TWAMP-Control Commands 🎀
TWAMP-Control commands conform to the rules defined in Section 3.4 of OWAMP [RFC4656].
The following commands are available for the Control-Client: Request-TW-Session, Start-Sessions, and Stop-Sessions. The Server can send specific messages in response to the commands it receives, as described in the sections that follow. ✨
Quick note: the OWAMP Request-Session command is replaced by the TWAMP Request-TW-Session command, and the Fetch-Session command does not appear in TWAMP at all. Gone, bestie 🙅♀️
3.5. Creating Test Sessions 🧚
Test session creation follows the same procedure as defined in Section 3.5 of OWAMP [RFC4656]. The Request-TW-Session command is based on the OWAMP Request-Session command. It uses the message format described in Section 3.5 of OWAMP, but without the Schedule Slot Descriptions field(s), and it uses only one HMAC. The description of the Request-TW-Session format follows, so get ready 💜
In TWAMP, the first octet is called the Command Number, and the Command Number is a recognized extension mechanism. Readers are encouraged to check the TWAMP-Control Command Number registry to see if there are any additional values assigned. Go look, it's giving research energy 🔍
The Command Number value of 5 indicates a Request-TW-Session command. The Server MUST interpret this command as a request for a two-way test session using the TWAMP-Test protocol. Very clear, very iconic 💅
If a TWAMP Server gets an unexpected Command Number, it MUST respond with the Accept field set to 3 (meaning "Some aspect of request is not supported") in the Accept-Session message. Command Numbers that are Forbidden (and possibly numbers that are Reserved) count as unexpected. 💀
Now the sender and reflector roles, which are kind of the heart of this whole thing 🦋 In OWAMP, the Conf-Sender field is set to 1 when the Request-Session message describes a task where the Server will configure a one-way test packet sender. Likewise, the Conf-Receiver field is set to 1 when the message describes the configuration for a Session-Receiver. In TWAMP, though, both endpoints send and receive test packets. The Session-Sender sends first and then receives, and the Session-Reflector receives first and then sends, so they complemented each other perfectly. 🫶
Both the Conf-Sender field and the Conf-Receiver field MUST be set to 0. That's because the Session-Reflector both receives and sends packets, and the roles get set based on which host starts the TCP connection for control. The Server MUST interpret any non-zero value as an improperly formatted command, and MUST respond with the Accept field set to 3 (meaning "Some aspect of request is not supported") in the Accept-Session message. Not allowed, periodt 🙅♀️
The Session-Reflector in TWAMP doesn't process incoming test packets for performance metrics, so it doesn't need to know how many incoming packets there are or their timing schedule. Because of that, the Number of Scheduled Slots and Number of Packets fields MUST be set to 0. Zero drama, zero slots 🌸
The Sender Port is the UDP port that TWAMP-Test packets are sent from, and it's also the port the Session-Reflector sends packets to. The Session-Sender uses that same UDP port to send and receive packets. The Receiver Port is the UDP port that the Session-Sender wants to send TWAMP-Test packets to. It's the port where the Session-Reflector is asked to receive test packets. The Receiver Port is also the UDP port that the Session-Reflector sends TWAMP-Test packets from, and the Session-Reflector uses that same UDP port to send and receive packets. Ports, ports, ports 🍒
The Sender Address and Receiver Address fields hold the sender and receiver addresses of the endpoints of the Internet path that a TWAMP-Test session is requested over. They MAY be set to 0. If they are, the IP addresses used for the Control-Client to Server TWAMP-Control message exchange MUST be used in the test packets. Fallback vibes 🧸
The Session Identifier (SID) is as defined in OWAMP [RFC4656]. The SID is always generated by the receiving side, so the Server determines the SID, and the SID in the Request-TW-Session message MUST be set to 0. The Server is in charge of that one 👑
The Start Time is as defined in OWAMP [RFC4656]. ⏰
The Timeout is interpreted differently from the OWAMP [RFC4656] definition, so pay attention 👀 In TWAMP, Timeout is the interval that the Session-Reflector MUST wait after receiving a Stop-Sessions message. If there are test packets still in transit, the Session-Reflector MUST reflect them as long as they arrive within the Timeout interval following the reception of the Stop-Sessions message. The Session-Reflector MUST NOT reflect packets that are received beyond the timeout. Late packets get ghosted 👻
The Type-P descriptor is as defined in OWAMP [RFC4656]. The only capability of this field is to set the Differentiated Services Code Point (DSCP) as defined in [RFC2474]. The same value of DSCP MUST be used in test packets reflected by the Session-Reflector. Consistency is everything, bestie 💖
Since there are no Schedule Slot Descriptions, the Request-TW-Session message is completed by the MBZ (Must Be Zero) and HMAC fields. Together those make up one logical message, which is called the Request-TW-Session command. Tidy and complete 🎀
The Session-Reflector MUST respond to each Request-TW-Session command with an Accept-Session message as defined in OWAMP [RFC4656]. When the Accept field = 0, the Port field confirms (repeats) the port that the Session-Sender sends TWAMP-Test packets to on the Session-Reflector. In other words, the Port field tells you the port number where the Session-Reflector expects to receive packets from the Session-Sender. Confirmed and repeated 🔁
When the requested Receiver Port is not available (for example, the port is in use), the Server at the Session-Reflector MAY suggest an alternate and available port for this session in the Port field. The Session-Sender either accepts that alternate port or composes a new Session-Request message with suitable parameters. Otherwise, the Server at the Control-Client uses the Accept field to convey other forms of session rejection or failure. In that case it MUST NOT suggest an alternate port, and the Port field MUST be set to zero. No backup port for you, sorry bestie 🙃
3.6. Send Schedules 📅
The send schedule for test packets defined in Section 3.6 of OWAMP [RFC4656] is not used in TWAMP. The Control-Client and Session-Sender MAY autonomously decide the send schedule. The Session-Reflector SHOULD return each test packet to the Session-Sender as quickly as possible. Fast replies only, it's a whole vibe ⚡
3.7. Starting Test Sessions 🚀
The procedure and guidelines for starting test sessions are the same as defined in Section 3.7 of OWAMP [RFC4656]. Same playbook, no surprises 🦋
3.8. Stop-Sessions ✨
okay so stopping test sessions is basically the same vibe as in OWAMP, so go check Section 3.8 of OWAMP [RFC4656] 🧚 💅 only the Control-Client can issue Stop-Sessions, and the message MUST NOT have any session description records or skip ranges 🙅♀️ it ends with one single block HMAC to finish the Stop-Sessions command 🔐 and here's the lowkey iconic part: Stop-Sessions doesn't carry SIDs, so it hits every session that was requested and started with a Start-Sessions command 💥 total "stop everything" energy 😭
Here's how the TWAMP Stop-Sessions command is built 🦋
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 3 | Accept | MBZ |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Number of Sessions |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| MBZ (8 octets) |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
| HMAC (16 octets) |
| |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+The Command Number in the first octet (3) tells you this is the Stop-Sessions command 🫶
Accept is where the drama lives 🎭 a non-zero value means something went wrong, and zero means a normal finish (even if it's a little early) 🌸 the full list of Accept values is in Section 3.3 of [RFC4656], "Values of the Accept Field" 📖
If Accept is non-zero, the results of every TWAMP-Test session spawned by this TWAMP-Control session SHOULD be considered invalid 🚫 and if the Accept-Session message never got sent at all (for whatever reason, including the TCP connection for TWAMP-Control failing), the results of those TWAMP-Test sessions MAY be considered invalid 🙈
Number of Sessions is how many sessions the Control-Client plans to stop 🔢 It MUST match the number of send sessions the Control-Client started that haven't already been ended by an earlier Stop-Sessions command, because the Control-Client MUST account for every accepted Request-Session 💅 if the count doesn't match exactly the sessions in progress, the message is invalid, the TWAMP-Control connection SHOULD be closed, and any results are considered invalid 💀
When the Session-Reflector gets a TWAMP-Control Stop-Sessions command, it MUST discard any TWAMP-Test packets arriving at the current time plus the Timeout (the one from the Request-TW-Session command) ⏰ no late packets allowed, periodt 💖
3.9. Fetch-Session 🍓
so the whole point of TWAMP is measuring two-way metrics 🌈 and two-way methods don't need the Session-Reflector to collect packet-level stuff (like sequence number, timestamp, and Time to Live (TTL)) because all that info comes back inside the "reflected" test packets 🪞 which means TWAMP doesn't need to pull packet-level data off the Server at all, so the OWAMP Fetch-Session command just isn't used in TWAMP 🙅♀️ not needed, bestie 💅
4. TWAMP-Test 🔥
the TWAMP-Test protocol is basically a cousin of the OWAMP-test protocol [RFC4656] 👯♀️ the one big difference is that the Session-Reflector sends a test packet back to the Session-Sender for every test packet it receives 🔁 TWAMP has two packet formats, one for what the Session-Sender sends and one for what the Session-Reflector sends back 🎀 and just like OWAMP-test, there are three modes: unauthenticated, authenticated, and encrypted 🔐✨
4.1. Sender Behavior 🦋
the Session-Sender's behavior is set by how it's configured, and this standard doesn't define it 🤷♀️ the Session-Reflector also doesn't need to know the Session-Sender's behavior in as much detail as OWAMP [RFC4656] requires 💁♀️ the Session-Sender collects and records whatever info it needs from the packets the Session-Reflector sends back so it can measure two-way metrics 📊 how that recording works, based on the packets the Session-Sender gets, is up to the implementation 🧚
4.1.1. Packet Timings ⏱️
since the send schedule never gets communicated to the Session-Reflector, there's no need for a standardized way to compute packet timing 🙌
no matter what scheduling delays happen, every packet that's actually sent MUST have the best possible approximation of its real time of departure as its timestamp (in the packet) ⭐
4.1.2. Packet Format and Content 🍓
the Session-Sender's packet format and content follow the same procedure and guidelines as Section 4.1.2 of OWAMP [RFC4656] (except for the reference to the send schedule) 📝
the Reflector's test packet formats are bigger than the Sender's, so heads up 👀 the Session-Sender MAY append enough Packet Padding so the same IP packet payload lengths can be used in each direction (this is usually desirable 💖) to make up for the bigger Reflector format, the Sender adds at least 27 octets of padding in unauthenticated mode, and at least 56 octets in authenticated and encrypted modes 🫶
4.2. Reflector Behavior 👑
TWAMP requires the Session-Reflector to send a packet back to the Session-Sender for each packet it receives 🔁
as packets come in, the Session-Reflector does the following ✨
- Timestamp the received packet. Every packet that's actually received MUST have the best possible approximation of its real time of arrival entered as its Received Timestamp (in the packet) 🕰️
- In authenticated or encrypted mode, decrypt the right sections of the packet body (the first block (16 octets) for authenticated, and 96 octets for encrypted), then check the integrity of the sections covered by the HMAC 🔓
- Copy the packet sequence number into the matching reflected packet going back to the Session-Sender 🔢
- Pull the Sender TTL value from the TTL/Hop Limit value of received packets. Session-Reflector implementations SHOULD fetch the TTL/Hop Limit value from the IP header of the packet, replacing the 255 the Session-Sender set 🧠 if an implementation doesn't fetch the actual TTL (the only good reason not to is not being able to access the TTL field of arriving packets), it MUST set the Sender TTL value to 255 💅
- In authenticated and encrypted modes, the HMAC MUST be calculated first, and then the right portion of the packet body gets encrypted 🔐
- Send a test packet back to the Session-Sender for every received packet. The response MUST be generated as immediately as possible 🏃♀️💨 the format and content of that test packet are defined in Section 4.2.1 🎀 before sending it, the Session-Reflector MUST enter the best possible approximation of its actual sending time as its Timestamp (in the packet) ⏳ this lets you figure out how long it took between receiving the packet and sending the response 🧮
- Packets not received within the Timeout (after the Stop-Sessions command) MUST be ignored by the Reflector. The Session-Reflector MUST NOT generate a test packet to the Session-Sender for packets that get ignored 🙅♀️
the Session-Sender could fail during a session, or the path between the Session-Sender and Session-Reflector could fail while a test session is running 😭 the Session-Reflector MAY end any session it started when no packet tied to that session has arrived for REFWAIT seconds 🧹 the default REFWAIT value SHALL be 900 seconds, and this waiting time MAY be configurable ⏲️ this timeout is how a Session-Reflector frees up resources when something goes wrong 💜
4.2.1. TWAMP-Test Packet Format and Content 🧚
the Session-Reflector MUST send a packet back to the Session-Sender for each packet it receives 🔁 it SHOULD send those packets as immediately as possible ⚡ and it SHOULD set the TTL in IPv4 (or Hop Limit in IPv6) in the UDP packet to 255 🌸
the test packet has the info needed to calculate two-way metrics on the Session-Sender side 📊 the format depends on the mode in use, and here are the two formats 👇
For unauthenticated mode:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Sequence Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Timestamp |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Error Estimate | MBZ |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Receive Timestamp |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Sender Sequence Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Sender Timestamp |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Sender Error Estimate | MBZ |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Sender TTL | |
+-+-+-+-+-+-+-+-+ +
| |
. .
. Packet Padding .
. .
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+For authenticated and encrypted modes:
Okay bestie, the TWAMP-Test packet is literally the main character of this whole section 🦋 Here's the layout, then the timestamp format it uses.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Sequence Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| MBZ (12 octets) |
| |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Timestamp |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Error Estimate | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +
| MBZ (6 octets) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Receive Timestamp |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| MBZ (8 octets) |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Sender Sequence Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| MBZ (12 octets) |
| |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Sender Timestamp |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Sender Error Estimate | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +
| MBZ (6 octets) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Sender TTL | |
+-+-+-+-+-+-+-+-+ +
| |
| |
| MBZ (15 octets) |
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
| HMAC (16 octets) |
| |
| |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-|
| |
. .
. Packet Padding .
. .
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Timestamps are giving OWAMP vibes 💜 They use the same format as OWAMP [RFC4656], like this:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Integer part of seconds |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Fractional part of seconds |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+The Sequence Number is the test packet's number based on transmit order 🔢 It starts at zero and goes up by one for each packet after that. The Session-Reflector makes its own Sequence Number, totally separate from the sequence numbers on the packets it receives 💅
The Timestamp and Error Estimate are the Session-Reflector's transmit timestamp and error estimate for the reflected test packet ✨ All the timestamp and error estimate fields follow the definitions and formats from OWAMP, Section 4.1.2 in [RFC4656] 🎀
Sender Timestamp and Sender Error Estimate are exact copies of the timestamp and error estimate from the Session-Sender test packet that matches this one 🫶
Sender TTL is 255 when the Session-Sender transmits it 🌈 When the Session-Reflector transmits it, Sender TTL gets set to the Time To Live (or Hop Count) value from the IP packet header of the received packet.
Receive Timestamp is the time the reflector received the test packet 📥 The difference between Timestamp and Receive Timestamp is how long the packet was hanging out inside the Session-Reflector ⏳ The Error Estimate tied to the Timestamp field also applies to the Receive Timestamp 💖
Sender Sequence Number is a copy of the Sequence Number from the packet the Session-Sender transmitted, the one that made the Session-Reflector generate and send this test packet 🍓
The HMAC field covers the same fields as the Advanced Encryption Standard (AES) encryption does 🔐 So in authenticated mode, HMAC covers the first block (16 octets). In encrypted mode, HMAC covers the first six blocks (96 octets). In TWAMP-Test, the HMAC field MUST NOT be encrypted 🙅♀️
Packet Padding in TWAMP-Test SHOULD be pseudo-random 🌀 (it MUST be generated independently of any other pseudo-random numbers mentioned in this document). However, implementations MUST provide a configuration parameter, an option, or a different means of making Packet Padding consist of all zeros 0️⃣ Packet Padding MUST NOT be covered by the HMAC and MUST NOT be encrypted.
The minimum data segment length of TWAMP-Test packets in unauthenticated mode is 41 octets, and 104 octets in both authenticated mode and encrypted modes 📏
Heads up: the Session-Reflector's test packet formats are bigger than the Sender's ones 👀 The Session-Reflector SHOULD reduce the length of the Sender's Packet Padding to get equal IP packet payload lengths in each direction, when there's enough padding present 🎯 The Session-Reflector MAY re-use the Sender's Packet Padding (since the padding generation requirements are the same for each). If it does, the Session-Reflector SHOULD truncate the padding so the highest-number octets get discarded ✂️
In unauthenticated mode, encryption or authentication MUST NOT be applied 🚫
The TWAMP-Test packet layout is identical in authenticated and encrypted modes 👯 The encryption operation for a Session-Sender packet follows the same Session-Sender rules as defined in OWAMP section 4.1.2 of [RFC4656] 🔒
The big difference between authenticated mode and encrypted mode is which parts of the test packets get covered by HMAC and encrypted 🧩 Authenticated mode lets the timestamp be fetched after a portion of the packet is encrypted. In encrypted mode, though, all the sequence numbers and timestamps get fetched before encryption, for maximum data-integrity protection 🛡️
In authenticated mode, only the sequence number in the first block gets encrypted, and the subsequent timestamps and sequence numbers go out in clear text. Sending the timestamp in clear text cuts down the time between when a Session-Reflector gets a timestamp and when that packet goes out. That potentially improves timestamp accuracy, since the sequence number can be encrypted before the timestamp is fetched ⏱️
In encrypted mode, the reflector MUST fetch the timestamps, generate the HMAC, and encrypt the packet, then send it 📮
Getting the keys and encryption methods works the same way as OWAMP, as described below 🗝️ Each TWAMP-Test session has two keys, an AES Session-key and an HMAC Session-key, and both are derived from the TWAMP-Control keys and the SID.
TWAMP-Test AES Session-key: take the TWAMP-Control AES Session-key (the same AES Session-key used for the corresponding TWAMP-Control session) and encrypt it with the 16-octet session identifier (SID) as the key, using single-block AES-ECB encryption. The result is the TWAMP-Test AES Session-key used to encrypt (and decrypt) the packets of that particular TWAMP-Test session 🔑 Note that the TWAMP-Test AES Session-key, TWAMP-Control AES Session-key, and the SID are all comprised of 16 octets 🍰
TWAMP-Test HMAC Session-key: take the TWAMP-Control HMAC Session-key (the same HMAC Session-key used for the corresponding TWAMP-Control session) and encrypt it using AES-CBC (Cipher Block Chaining) with the 16-octet session identifier (SID) as the key. This is a two-block CBC encryption that's always performed with IV=0 🧁 Note that the TWAMP-Test HMAC Session-key and TWAMP-Control HMAC Session-key are comprised of 32 octets, while the SID is 16 octets 📐
In authenticated mode, the first block (16 octets) of each TWAMP-Test packet is encrypted using the AES Electronic Codebook (ECB) mode. No chaining is involved, so lost, duplicated, or reordered packets don't cause problems when deciphering any packet in a TWAMP-Test session 🙌
In encrypted mode, the first six blocks (96 octets) are encrypted using AES-CBC mode. The AES Session-key to use is obtained the same way as the key for authenticated mode. Each TWAMP-Test packet is encrypted as a separate stream, with just one chaining operation. Chaining never spans multiple packets, so lost, duplicated, or reordered packets don't cause problems 🧵 The initialization vector for the CBC encryption is a value with all bits equal to zero 0️⃣
Implementation Note: Naturally, the key schedule for each TWAMP-Test session MUST be set up at most once per session, not once per packet 🗓️✨
5. Implementers' Guide ✨
okay so this section is basically a friendly heads-up for anyone building TWAMP 🎀 it is NOT a requirement, just an example architecture, bestie. TWAMP is designed to be flexible, the same way OWAMP [RFC4656] is, so it can fit lots of different system setups 🦋
in the example, one host is the controller and it plays both the Control-Client and Session-Sender roles 💅 the other host is the responder and it plays the Server and Session-Reflector roles 🌸
controller responder
+-----------------+ +-------------------+
| Control-Client |<--TWAMP-Control-->| Server |
| | | |
| Session-Sender |<--TWAMP-Test----->| Session-Reflector |
+-----------------+ +-------------------+this setup covers the full TWAMP standard 👑 the controller sets up the test session with the responder over TWAMP-Control, and once that's done, the controller sends test packets over to the responder. the responder acts like a Session-Reflector following the behavior in Section 4.2 ✨
there's also Appendix I 🧚 which is purely informational, and it shows a gentle path for adopting TWAMP by implementing the TWAMP-Test protocol first 🍓
6. Security Considerations 🔐
okay this part is SO important, bestie 😭 TWAMP and OWAMP use the same protocol for setting up Control and Test procedures. the big difference is that TWAMP has a Session-Reflector and OWAMP has a Session-Receiver 💜 that difference doesn't add any known security holes that OWAMP doesn't already handle, and the whole security considerations section of OWAMP [RFC4656] applies to TWAMP too 🛡️
the Server-Greeting message (from Section 3.1 of [RFC4656]) has a Count field that sets the iteration counter for PKCS #5 when generating keys from shared secrets 🔑 OWAMP recommends a lower limit of 1024 iterations but no upper limit, and that's where things get dicey 😬 because Count is 32 bits long, it's a possible denial-of-service (DOS) attack target 💀 if an attacker sets Count to the max value (2**32), the system under attack could stall for a long time while it tries to generate keys
so, TWAMP-compliant systems SHOULD have a configuration control that limits the maximum Count value 🙏 the default maximum Count value SHOULD be 32768 🌈 and like OWAMP suggested, this value MAY be increased once greater computing power becomes common 💪 and if a Control-Client gets a Server-Greeting with a Count greater than its maximum configured value, it SHOULD close the control connection 🚪✨
7. Acknowledgements 💖
huge thanks to Nagarjuna Venna, Sharee McNab, Nick Kinraid, Stanislav Shalunov, Matt Zekauskas, Walt Steverson, Jeff Boote, Murtaza Chiba, and Kevin Earnst 🫶 for their comments, suggestions, reviews, helpful discussion, and proof-reading 🎀 Lars Eggert, Sam Hartman, and Tim Polk gave super useful AD-level reviews, and the authors are so grateful to them for their contributions to the memo 👑
8. IANA Considerations 📋
IANA allocated a well-known TCP port number (861) for the OWAMP-Control part of the OWAMP [RFC4656] protocol 🍓
...
owamp-control 861/tcp OWAMP-Control
owamp-control 861/udp OWAMP-Control
# [RFC4656]IANA also allocated a well-known TCP/UDP port number for TWAMP-Control 🦋
...
twamp-control 862/tcp Two-way Active Measurement Protocol
(TWAMP) Control
twamp-control 862/udp Two-way Active Measurement Protocol
(TWAMP) Control
# [RFC5357]
# 863-872 Unassignedsince TWAMP adds an extra Control command beyond the OWAMP-Control spec and describes how it behaves, IANA made a registry for the TWAMP Command Number field 🌟 the field isn't explicitly named in [RFC4656], but it's called out for each command, and it's a recognized extension mechanism for TWAMP 💅
8.1. Registry Specification 📝
IANA made a TWAMP-Control Command Number registry 🎀 TWAMP-Control commands are identified by the first octet in OWAMP-Control messages, as shown in Section 3.5 of [RFC4656] and modified by this document 🌸 so this registry may contain sixteen possible values ✨
8.2. Registry Management 🗂️
the registry can only hold sixteen values, and since OWAMP and TWAMP are IETF protocols, it MUST only be updated by "IETF Consensus" as specified in [RFC5226], which means an RFC documenting the use that the IESG approves 👑 the authors expect new values to be assigned as monotonically increasing integers in the range [0-15], unless there's a really good reason to do otherwise 💜
8.3. Experimental Numbers 🧪
[RFC3692] recommends setting aside some values for experimentation and testing 🔬 the authors weren't sure how many numbers would be useful here, or whether it would help if they were easy to tell apart or sat at the "high end" of the range 🤔 two might be useful, say one for session control and one for session fetch 🌈 on the other hand, a single number would allow unlimited extension, because the rest of the message format could be tailored, with other numbers allocated once usefulness is proven ✨ so this document allocates one number (6) for experimentation and testing 🧚
8.4. Initial Registry Contents 📚
TWAMP-Control Command Number Registry 🎀
Value Description Semantics Definition
0 Reserved
1 Forbidden
2 Start-Sessions RFC 4656, Section 3.7
3 Stop-Sessions RFC 4656, Section 3.8
4 Reserved
5 Request-TW-Session this document, Section 3.5
6 Experimentation undefined, see Section 8.3.9. Internationalization Considerations 🌍
the protocol doesn't carry any natural-language info, with one possible exception: the KeyID in TWAMP-Control, which is encoded in UTF-8 [RFC3629, RFC5198] 💖
Appendix I - TWAMP Light (Informative) 🧚
in this example, the roles of Control-Client, Server, and Session-Sender live on one host called the controller, and the Session-Reflector role lives on another host called the responder 🌸
controller responder
+-----------------+ +-------------------+
| Server |<----------------->| |
| Control-Client | | Session-Reflector |
| Session-Sender |<--TWAMP-Test----->| |
+-----------------+ +-------------------+this is a simple setup for responders whose only job is to act as light test points in the network 🦋 the controller sets up the test session with the Server through non-standard means, and after that, it sends test packets to the responder 💅 the responder follows the Session-Reflector behavior from section 4.2, with these exceptions 👀
in TWAMP Light, the Session-Reflector doesn't necessarily know the session state 🤷♀️ IF the Session-Reflector doesn't know the session state, THEN the Session-Reflector MUST copy the Sequence Number of the received packet into the Sequence Number field of the reflected packet 🚨 the controller gets the reflected test packets and collects two-way metrics, so this architecture still lets you collect two-way metrics 📈
this setup gets rid of the need for TWAMP-Control 🙅♀️ and it assumes the Session-Reflector is configured, and it communicates that configuration with the Server through non-standard means 🛠️ the Session-Reflector just reflects incoming packets back to the controller, copying the necessary info and generating sequence number and timestamp values per Section 4.2.1 ✨
TWAMP Light brings some extra security considerations, bestie 😬 the non-standard means of controlling the responder and setting up test sessions SHOULD offer the features listed below.
the non-standard responder control protocol SHOULD have an authenticated mode of operation 🔐 and the responder SHOULD be configurable to accept only authenticated control sessions 🙅♀️
the non-standard responder control protocol SHOULD have a way to activate the authenticated and encrypted modes of the TWAMP-Test protocol 🔑
when TWAMP Light test sessions run in authenticated or encrypted mode, the Session-Reflector MUST have some mechanism for generating keys 🗝️ (because TWAMP-Control normally helps with this, but it isn't here) the spec for the key generation mechanism is beyond the scope of this memo 🌈
Normative References 📖
[RFC4656] Shalunov, S., Teitelbaum, B., Karp, A., Boote, J., and M. Zekauskas, "A One-way Active Measurement Protocol (OWAMP)", RFC 4656, September 2006.
[RFC2681] Almes, G., Kalidindi, S., and M. Zekauskas, "A Round-trip Delay Metric for IPPM", RFC 2681, September 1999.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2474] Nichols, K., Blake, S., Baker, F., and D. Black, "Definition of the Differentiated Services Field (DS Field) in the IPv4 and IPv6 Headers", RFC 2474, December 1998.
[RFC5226] Narten, T. and H. Alvestrand, "Guidelines for Writing an IANA Considerations Section in RFCs", BCP 26, RFC 5226, May 2008.
[RFC3629] Yergeau, F., "UTF-8, a transformation format of ISO 10646", STD 63, RFC 3629, November 2003.
[RFC5198] Klensin, J. and M. Padlipsky, "Unicode Format for Network Interchange", RFC 5198, March 2008.
Informative References 📚
[RFC3692] Narten, T., "Assigning Experimental and Testing Numbers Considered Useful", BCP 82, RFC 3692, January 2004.
Authors' Addresses 💌
Kaynam Hedayat Brix Networks 285 Mill Road Chelmsford, MA 01824 USA EMail: khedayat@brixnet.com URI: http://www.brixnet.com/
Roman M. Krzanowski, Ph.D. Verizon 500 Westchester Ave. White Plains, NY USA EMail: roman.krzanowski@verizon.com URI: http://www.verizon.com/
Al Morton AT&T Labs Room D3 - 3C06 200 Laurel Ave. South Middletown, NJ 07748 USA Phone +1 732 420 1571 EMail: acmorton@att.com URI: http://home.comcast.net/~acmacm/
Kiho Yum Juniper Networks 1194 Mathilda Ave. Sunnyvale, CA USA EMail: kyum@juniper.net URI: http://www.juniper.com/
Jozef Z. Babiarz Nortel Networks 3500 Carling Avenue Ottawa, Ont K2H 8E9 Canada Email: babiarz@nortel.com URI: http://www.nortel.com/
Full Copyright Statement 🎀
Copyright (C) The IETF Trust (2008). The IETF Trust holds the copyright on this one, bestie 💅
This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights. So the BCP 78 rules apply, and the authors keep whatever rights those rules don't take away 🫶
This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 💀
Intellectual Property ✨
The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document, or the extent to which any license under such rights might or might not be available. It also doesn't claim it has made any independent effort to identify any such rights 🧐 Info on how rights work for RFC documents lives in BCP 78 and BCP 79, so go check those out 📚
Copies of IPR disclosures made to the IETF Secretariat, and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification, can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr 🦋
The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Send that info to the IETF at ietf-ipr@ietf.org 💜 iykyk, and now you do too ✨
📦 where this page comes from
- ietf: rfc5357 2008-10
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms