RFC 6888
Common Requirements for Carrier-Grade NATs (CGNs)
Common Requirements for Carrier-Grade NATs (CGNs) 🎀
- RFC number: 6888 🦋, a Best Current Practice (BCP 127), so it's official IETF guidance and not just a suggestion 💅
- Date: April 2013 🌸
- Editors and authors: S. Perreault, Ed. (Viagenie), I. Yamagata, S. Miyakawa (NTT Communications), A. Nakagawa (Japan Internet Exchange, JPIX), and H. Ashida (Cisco Systems) 🫶
- Updates: RFC 4787 ✨. It doesn't obsolete anything.
- ISSN: 2070-1721
Okay so this doc is all about the rules that Carrier-Grade NATs (CGNs) have to follow so that apps keep working for everybody. It's the bestie-level version of the spec 💜
Abstract
Okay, the abstract is super short and sweet 🍓 It says this document defines common requirements for Carrier-Grade NATs (CGNs), and that it updates RFC 4787 ✨
Status of This Memo
This memo is an Internet Best Current Practice 💖
This document is made by the Internet Engineering Task Force (IETF), and it reflects what the IETF community agreed on. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). If you want more info on BCPs, check Section 2 of RFC 5741 🧚
For the current status of this doc, any errata, and how to send feedback, go to http://www.rfc-editor.org/info/rfc6888 🌈
Copyright Notice
Copyright (c) 2013 IETF Trust and the persons identified as the document authors. All rights reserved. ⭐
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info), as they were in effect on the date this document was published. Please read these carefully, because they spell out your rights and restrictions for this doc 🫶 If you pull Code Components out of this document, they must include the Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions. They also come with no warranty, as described in the Simplified BSD License 💅
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . 3
3. Requirements for CGNs . . . . . . . . . . . . . . . . . . . 4
4. Logging . . . . . . . . . . . . . . . . . . . . . . . . . . 10
5. Port Allocation Scheme . . . . . . . . . . . . . . . . . . . 11
6. Deployment Considerations . . . . . . . . . . . . . . . . . 11
7. Security Considerations . . . . . . . . . . . . . . . . . . 12
8. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 12
9. References . . . . . . . . . . . . . . . . . . . . . . . . . 12
9.1. Normative References . . . . . . . . . . . . . . . . . 12
9.2. Informative Reference . . . . . . . . . . . . . . . . . 131. Introduction ✨
Okay so, IPv4 addresses are running low, and that means more ISPs are going to want a service where one public IPv4 address gets shared by a bunch of subscribers 🦋 Each subscriber gets a private address, and a Network Address Translator (NAT) [RFC2663] sitting in the ISP's network translates traffic between the private and public addresses. If there's a second IPv4 NAT at the customer edge, you end up with two layers of NAT, which is a whole vibe 💀
This service can be offered alongside other stuff, like IPv6 services or regular IPv4 service where subscribers get public addresses 🌸 Some ISPs started doing this way before IPv4 ran short, so the shortage isn't the only reason people are doing it 👑 One approach to CGN deployment is described in [RFC6264] 🎀
Here's the tea: this document describes behavior that multi-subscriber NATs need for interoperability 🍓 It is not an IETF endorsement of CGNs, and it's not a real specification for CGNs either. It's just a minimal set of requirements that makes it more likely that apps will work across CGNs 🫶
Because subscribers don't get unique IPv4 addresses, Carrier-Grade NATs cause some big limitations for communication between subscribers and with the rest of the Internet 😭 In particular, setting up proxy functionality at the border between the internal and external realms is a lot more involved. Some apps might need major upgrades, and some might not work at all in this setup 💅 For more details, check "Issues with IP Address Sharing" [RFC6269] 🧚
This document builds on earlier work that sets requirements for generic NATs [RFC4787][RFC5382][RFC5508]. Those documents, and any updates to them, still apply in this context. What comes next is extra requirements, and they're on top of the earlier ones 🔥
2. Terminology 🌈
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 💖
Readers are expected to know "Network Address Translation (NAT) Behavioral Requirements for Unicast UDP" [RFC4787] and the terms defined there 🦋 This document uses one more term:
Carrier-Grade NAT (CGN): A NAT-based [RFC2663] logical function used to share the same IPv4 address among several subscribers. A CGN is not managed by the subscribers. 🫶
Note that the term "carrier-grade" has nothing to do with how good the NAT is. That's up to the implementers 🙈 It's really a topological qualifier: the NAT sits in an ISP's network and translates traffic for potentially lots of subscribers. Subscribers have limited or no control over the CGN, whereas they usually have full control over a NAT on their own premises 👑
Note also that the CGN described in this document is IPv4-only. IPv6 address translation is not considered 💅
That said, the scenario where the IPv4-only CGN logical function gets used might include IPv6 elements. For example, Dual-Stack Lite (DS-Lite) [RFC6333] uses an IPv4-only CGN logical function in a scenario that uses IPv6 encapsulation. So this document would also apply to the CGN part of DS-Lite ✨
Figure 1 gives a quick summary of a common network topology where a CGN operates 🌸
.
:
| Internet
............... | ...................
| ISP network
External pool: |
192.0.2.1/26 |
++------++ External realm
........... | CGN |...............
++------++ Internal realm
10.0.0.1 | |
| |
| | ISP network
............. | .. | ................
| | Customer premises
10.0.0.100 | | 10.0.0.101
++------++ ++------++
| CPE1 | | CPE2 | etc.
++------++ ++------++
(IP addresses are only for example purposes)
Figure 1: CGN Network TopologyAnother possible topology is for hotspots 🧚 In that case there's no customer premises or customer premises equipment (CPE). Instead, a CGN serves a bunch of customers who don't trust each other, so fairness is a real issue 😭 The big difference from the previous topology is that there's no second layer of NAT. But that doesn't change the CGN requirements at all, because they're driven by fairness and robustness in the service given to customers, and that applies in both cases 💜
3. Requirements for CGNs ✨
okay bestie, this is where the actual rulebook for CGNs starts 🎀 these are extra requirements, stacked on top of the ones in [RFC4787], [RFC5382], and [RFC5508] 💅
REQ-1: If a CGN forwards packets carrying a given transport protocol, it MUST meet that protocol's behavioral requirements 🦋 the current docs are:
- a. "NAT Behavioral Requirements for Unicast UDP" [RFC4787]
- b. "Network Address Translation (NAT) Behavioral Requirements for TCP" [RFC5382]
- c. "NAT Behavioral Requirements for ICMP" [RFC5508]
- d. "Network Address Translation (NAT) Behavioral Requirements for the Datagram Congestion Control Protocol (DCCP)" [RFC5597]
and any future NAT behavioral docs for IPv4 transport protocols will pile on even MORE requirements for CGNs 🌈
Justification: CGNs need to keep as many apps working as possible, so the IETF already wrote down the best current practices for UDP, TCP, ICMP, and DCCP 🧚
REQ-2: A CGN MUST default its "IP address pooling" behavior to "Paired" (see Section 4.1 of [RFC4787]) 🌸 it MAY let admins change this per application protocol 💜
- * When several overlapping internal IP address ranges share one external IP address pool (for example, DS-Lite [RFC6333]), the "IP address pooling" behavior applies to mappings between external IP addresses and internal subscribers, NOT between external and internal IP addresses 🙈
Justification: this is a stronger version of REQ-2 from [RFC4787] because breaking apps that count on the external address staying the same is a big deal 😭
This requirement applies no matter the transport protocol, fr fr. A CGN MUST use the same external IP address mapping for every session tied to the same internal IP address, whether it's TCP, UDP, ICMP, something else, or a mix 🫶
Letting other behaviors exist is so admins can save external addresses and ports for app protocols that are known to work fine with them in practice 🍓 BUT the default MUST still be "Paired" 👑
REQ-3: The CGN function SHOULD NOT have any limits on the size or contiguity of the external address pool 🌈 specifically, the CGN function MUST be configurable with contiguous or non-contiguous external IPv4 address ranges 💖
Justification: IPv4 addresses are getting rarer by the day 😭 so it's getting harder for operators to hand CGNs big contiguous pools. Plus, operational flexibility can need non-contiguous pools for things like differentiated services, routing management, and so on ✨
The reason this is SHOULD NOT instead of MUST NOT is to account for limits from available resources and constraints from security reasons 🔥
REQ-4: A CGN MUST support limiting how many external ports (or, equivalently, "identifiers" for ICMP) get assigned per subscriber 🎀
- a. Per-subscriber limits MUST be configurable by the CGN administrator.
- b. Per-subscriber limits MAY be configurable independently for each transport protocol.
- c. On top of that, it is RECOMMENDED that the CGN include administrator-adjustable thresholds so one subscriber can't eat up excessive CPU from the CGN (for example, rate-limiting how fast the subscriber creates new mappings) 💅
Justification: a CGN is a shared resource that competing subscribers fight over 😤 capping the number of external ports per subscriber stops one subscriber from launching a denial-of-service (DoS) attack on the others to grab a bigger slice, so it keeps things fair ⚖️ rate-limiting allocation does the same job when the CPU is the thing being targeted instead of port numbers 🧠 this one isn't a MUST because it's super hard to call out every CPU-hungry event explicitly 🙃
REQ-5: A CGN SHOULD support limiting the amount of state memory allocated per mapping and per subscriber 💜 this may include limiting the number of sessions, the number of filters, and so on, depending on the NAT implementation 🌸
- a. Limits SHOULD be configurable by the CGN administrator.
- b. On top of that, it SHOULD be possible to limit the rate at which memory-hungry state elements get allocated.
Justification: a NAT has to keep track of TCP sessions for each mapping, and that state eats resources that subscribers can end up competing for 🍓 so every subscriber needs a fair share of the CGN's resources 🫶 limiting the allocation rate is meant to stop CPU resource exhaustion 😵💫 item "b" is only at the SHOULD level because other methods than rate limiting can reach the same goal 🦋
REQ-6: It MUST be possible to administratively turn off translation for specific destination addresses and/or ports 🙅♀️
Justification: CGN admins very commonly give subscribers access to servers sitting in the ISP's network on the external side 🧚 when such a server can reach the internal side through normal routing (which the ISP fully controls), translation isn't needed 💅 then the CGN can forward packets without changing them, acting like a plain router 🎀 that can be a big efficiency win ✨
Figure 2 shows this use case 👇
X1:x1 X1':x1' X2:x2
+---+from X1:x1 +---+from X1:x1 +---+
| C | to X2:x2 | | to X2:x2 | S |
| l |>>>>>>>>>>>>| C |>>>>>>>>>>>>>>| e |
| i | | G | | r |
| e |<<<<<<<<<<<<| N |<<<<<<<<<<<<<<| v |
| n |from X2:x2 | |from X2:x2 | e |
| t | to X1:x1 | | to X1:x1 | r |
+---+ +---+ +---+
Figure 2: CGN Pass-ThroughREQ-7: It is RECOMMENDED that a CGN use an "endpoint-independent filtering" behavior (see Section 5 of [RFC4787]) 🌷 if it's known that "Address-Dependent Filtering" won't break the application-layer protocol (how to figure that out is out of scope for this document), then it MAY be used instead 🙌
Justification: this is a stronger version of REQ-8 from [RFC4787] 💫 some games and peer-to-peer apps need EIF for NAT traversal to work, so for a CGN it's super important to minimize app breakage 🎮
REQ-8: Once an external port is deallocated, it SHOULD NOT be reallocated to a new mapping until at least 120 seconds have passed, with these exceptions:
- a. If the CGN tracks TCP sessions (for example, with a state machine, as in Section 3.5.2.2 of [RFC6146]), TCP ports MAY be reused immediately 🌊
- b. If external ports are statically assigned to internal addresses (for example, address X with port range 1000-1999 goes to subscriber A, 2000-2999 to subscriber B, and so on), and the assignment stays constant across state loss, then ports MAY be reused immediately 💜
- c. If the allocated external ports used address-dependent or address-and-port-dependent filtering before state loss, they MAY be reused immediately 🦋
The length of time and the maximum number of ports in this state MUST be configurable by the CGN administrator 🎀
Justification: this is needed to stop collisions between old and new mappings and sessions 💀 it makes sure that every established session gets broken instead of quietly redirected to a different peer 😱
The exceptions exist for cases where reusing a port right away can't send packets to the wrong peer 🙌 you can imagine other exceptions where mapping collisions are avoided too, which is why this stays at the SHOULD level 🧚
The 120 seconds comes from the Maximum Segment Lifetime (MSL) in [RFC0793] ⏳
Also, this requirement applies when a CGN loses state (because of a crash, reboot, failover to a cold standby, and so on) 🥶 in that case, ports that were in use at the time of state loss SHOULD NOT be reallocated until at least 120 seconds have passed 🕰️
REQ-9: A CGN MUST implement a protocol that gives subscribers explicit control over NAT mappings 🫶 that protocol SHOULD be the Port Control Protocol [RFC6887] 👑
Justification: letting subscribers manipulate the NAT state table with PCP hugely boosts the odds that apps work properly 🔥
A study of PCP-less CGN impacts is in [NAT444] 📚 another study on how PCP affects a peer-to-peer file sharing protocol is in [BITTORRENT] 🌈
REQ-10: CGN implementers SHOULD make their equipment manageable 🛠️ standards-based management, using standards like "Definitions of Managed Objects for NAT" [RFC4008], is RECOMMENDED 💖
Justification: CGNs are expected to mostly live in ISP networks, where management is critical 🌐 this is at the SHOULD level because some CGN operators may not need management functionality 🙃
There are also IETF efforts toward a MIB tailored for CGNs (for example, [NAT-MIB]) 🧠
REQ-11: When a CGN can't create a dynamic mapping because of resource constraints or administrative restrictions (that is, quotas) 🚫
- a. it MUST drop the original packet;
- b. it SHOULD send an ICMP Destination Unreachable message with code 1 (Host Unreachable) to the sender;
- c. it SHOULD send a notification (for example, an SNMP trap) to a management system (if configured to do so); and
- d. it MUST NOT delete existing mappings in order to "make room" for the new one. (This only applies to normal CGN behavior, not to manual operator intervention.)
Justification: this is a slightly different form of REQ-8 from [RFC5508] ✨ code 1 is preferred over code 13 because it's listed as a "soft error" in [RFC1122], which matters because we really don't want TCP stacks aborting the connection attempt in this case 😩 see [RFC5461] for details on how TCP reacts to soft errors 🔍
Sending ICMP errors and SNMP traps may be rate-limited for security reasons, which is why items B and C are SHOULDs, not MUSTs 🛡️
Apps generally handle connection establishment failure better than established-connection failure 💅 that's why dropping the packet that starts the new connection is preferred over deleting existing mappings 🫶 see also the rationale in Section 6 of [RFC5508] 🎀
4. Logging 🎀
okay so bestie, CGN admins sometimes NEED to figure out which subscriber did something sus 🙈 like when a bunch of people share one external address, the source address and port the destination sees are NOT the ones the subscriber actually sent from. so to trace it back, the CGN has to log this stuff for every mapping it creates (this list is just for info, it's not a requirement 💅):
- transport protocol
- subscriber identifier (e.g., internal source address or tunnel endpoint identifier)
- external source address
- external source port
- timestamp
a "subscriber identifier" just means anything that uniquely identifies a subscriber ✨ in a traditional NAT setup, the internal source address is enough. but with DS-Lite, a bunch of subscribers share the same internal address, so the subscriber identifier is the tunnel endpoint identifier (aka the B4's IPv6 address) 🧚
ngl the downside is that a busy CGN can produce HUGE amounts of logs, and that needs a lot of storage 😭
REQ-12: A CGN SHOULD NOT log destination addresses or ports unless required to do so for administrative reasons.
Justification: logging destinations at the CGN creates privacy issues 🙈 also, readers should know about the logging recommendations for Internet-facing servers [RFC6302]. with compliant servers, the CGN doesn't need to log the destination address and port, which helps cut down on logging 💖
this one is at the SHOULD level because there might be other reasons to log destinations, like if the remote server isn't following [RFC6302] 🫶
5. Port Allocation Scheme 🦋
a CGN's port allocation scheme has to juggle three competing requirements, bestie 💅
REQ-13: A CGN's port allocation scheme SHOULD maximize port utilization.
Justification: external ports are one of the resources a CGN shares, so managing them well directly affects how good a subscriber's connection is 🔥
some schemes are super efficient with ports (nothing wasted, iconic 👑). others systematically waste ports 💀
REQ-14: A CGN's port allocation scheme SHOULD minimize log volume.
Justification: huge log volumes can be a nightmare for CGN operators 😭
some schemes make one log entry per mapping. others let multiple mappings share a single log entry, which can sometimes be expressed super compactly 🌸 with some schemes, the logging frequency can get close to that of DHCP servers 🍓
REQ-15: A CGN's port allocation scheme SHOULD make it hard for attackers to guess port numbers.
Justification: easily guessed port numbers put subscribers at risk of the attacks described in [RFC6056] 🥺
some schemes are really secure because the port numbers aren't easy to guess 🛡️ others leave subscribers exposed 💀
a CGN implementation's choice of port allocation scheme optimizes for one requirement at the expense of another, periodt 💅 so these are soft requirements (SHOULD as opposed to MUST) ✨
6. Deployment Considerations 🌈
several issues come up when CGNs are used [RFC6269] 🫠 the IETF is currently working on some of them. for example, see [NAT-REVEAL] 🔍
7. Security Considerations 🚨
If a malicious subscriber can spoof another subscriber's CPE, it may cause a DoS to that subscriber by creating mappings up to the allowed limit. An ISP can prevent this with ingress filtering, as described in [RFC2827]. 😭
this document recommends endpoint-independent filtering (EIF) as the default filtering behavior for CGNs 💜 EIF has security considerations that are discussed in [RFC4787] 🧐
NATs sometimes do fragment reassembly. CGNs would do so at presumably high data rates, so the reader should be familiar with the potential security issues described in [RFC4963] ⚠️ bestie please read it 🙏
8. Acknowledgements 🫶
thank you SO much to everyone who gave input and reviewed this: Alexey Melnikov, Arifumi Matsumoto, Barry Leiba, Benson Schliesser, Dai Kuwabara, Dan Wing, Dave Thaler, David Harrington, Francis Dupont, Jean-Francois Tremblay, Joe Touch, Lars Eggert, Kousuke Shishikura, Mohamed Boucadair, Martin Stiemerling, Meng Wei, Nejc Skoberne, Pete Resnick, Reinaldo Penno, Ron Bonica, Sam Hartman, Sean Turner, Senthil Sivakumar, Stephen Farrell, Stewart Bryant, Takanori Mizuguchi, Takeshi Tomochika, Tina Tsou, Tomohiro Fujisaki, Tomohiro Nishitani, Tomoya Yoshida, Wes George, Wesley Eddy, and Yasuhiro Shirasaki 💖✨
9. References 📚
9.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC4008] Rohit, R., Srisuresh, P., Raghunarayan, R., Pai, N., and
C. Wang, "Definitions of Managed Objects for Network
Address Translators (NAT)", RFC 4008, March 2005.
[RFC4787] Audet, F. and C. Jennings, "Network Address Translation
(NAT) Behavioral Requirements for Unicast UDP", BCP 127,
RFC 4787, January 2007.
[RFC5382] Guha, S., Biswas, K., Ford, B., Sivakumar, S., and P.
Srisuresh, "NAT Behavioral Requirements for TCP", BCP 142,
RFC 5382, October 2008.
[RFC5508] Srisuresh, P., Ford, B., Sivakumar, S., and S. Guha, "NAT
Behavioral Requirements for ICMP", BCP 148, RFC 5508,
April 2009.
[RFC5597] Denis-Courmont, R., "Network Address Translation (NAT)
Behavioral Requirements for the Datagram Congestion
Control Protocol", BCP 150, RFC 5597, September 2009.
[RFC6887] Wing, D., Ed., Cheshire, S., Boucadair, M., Penno, R., and
P. Selkirk, "Port Control Protocol (PCP)", RFC 6887,
April 2013.9.2. Informative Reference
[RFC0793] Postel, J., "Transmission Control Protocol", STD 7, RFC
793, September 1981.
[RFC1122] Braden, R., "Requirements for Internet Hosts -
Communication Layers", STD 3, RFC 1122, October 1989.
[RFC2663] Srisuresh, P. and M. Holdrege, "IP Network Address
Translator (NAT) Terminology and Considerations", RFC
2663, August 1999.
[RFC2827] Ferguson, P. and D. Senie, "Network Ingress Filtering:
Defeating Denial of Service Attacks which employ IP Source
Address Spoofing", BCP 38, RFC 2827, May 2000.
[RFC4963] Heffner, J., Mathis, M., and B. Chandler, "IPv4 Reassembly
Errors at High Data Rates", RFC 4963, July 2007.
[RFC5461] Gont, F., "TCP's Reaction to Soft Errors", RFC 5461,
February 2009.
[RFC6056] Larsen, M. and F. Gont, "Recommendations for Transport-
Protocol Port Randomization", BCP 156, RFC 6056, January
2011.
[RFC6146] Bagnulo, M., Matthews, P., and I. van Beijnum, "Stateful
NAT64: Network Address and Protocol Translation from IPv6
Clients to IPv4 Servers", RFC 6146, April 2011.
[RFC6264] Jiang, S., Guo, D., and B. Carpenter, "An Incremental
Carrier-Grade NAT (CGN) for IPv6 Transition", RFC 6264,
June 2011.
[RFC6269] Ford, M., Boucadair, M., Durand, A., Levis, P., and P.
Roberts, "Issues with IP Address Sharing", RFC 6269, June
2011.
[RFC6302] Durand, A., Gashinsky, I., Lee, D., and S. Sheppard,
"Logging Recommendations for Internet-Facing Servers", BCP
162, RFC 6302, June 2011.
[RFC6333] Durand, A., Droms, R., Woodyatt, J., and Y. Lee, "Dual-
Stack Lite Broadband Deployments Following IPv4
Exhaustion", RFC 6333, August 2011.
[NAT-MIB] Perreault, S., Tsou, T., and S. Sivakumar, "Additional
Managed Objects for Network Address Translators (NAT)",
Work in Progress, February 2013.
[NAT-REVEAL]
Boucadair, M., Touch, J., Levis, P., and R. Penno,
"Analysis of Solution Candidates to Reveal a Host
Identifier (HOST_ID) in Shared Address Deployments", Work
in Progress, April 2013.
[NAT444] Donley, C., Ed., Howard, L., Kuarsingh, V., Berg, J., and
J. Doshi, "Assessing the Impact of Carrier-Grade NAT on
Network Applications", Work in Progress, April 2013.
[BITTORRENT]
Boucadair, M., Zheng, T., Deng, X., and J. Queiroz,
"Behavior of BitTorrent service in PCP-enabled networks
with Address Sharing", Work in Progress, May 2012.Authors' Addresses 💌
Simon Perreault (editor)
Viagenie
246 Aberdeen
Quebec, QC G1R 2E1
Canada
Phone: +1 418 656 9254
EMail: simon.perreault@viagenie.ca
URI: http://www.viagenie.ca
Ikuhei Yamagata
NTT Communications Corporation
Gran Park Tower 17F, 3-4-1 Shibaura, Minato-ku
Tokyo 108-8118
Japan
Phone: +81 50 3812 4704
EMail: ikuhei@nttv6.jp
Shin Miyakawa
NTT Communications Corporation
Gran Park Tower 17F, 3-4-1 Shibaura, Minato-ku
Tokyo 108-8118
Japan
Phone: +81 50 3812 4695
EMail: miyakawa@nttv6.jp
Akira Nakagawa
Japan Internet Exchange Co., Ltd. (JPIX)
Otemachi Building 21F, 1-8-1 Otemachi, Chiyoda-ku
Tokyo 100-0004
Japan
Phone: +81 90 9242 2717
EMail: a-nakagawa@jpix.ad.jp
Hiroyuki Ashida
Cisco Systems
Midtown Tower, 9-7-1, Akasaka
Minato-Ku, Tokyo 107-6227
Japan
EMail: hiashida@cisco.com📦 where this page comes from
- ietf: rfc6888 2013-04
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms