RFC 8313
Use of Multicast across Inter-domain Peering Points
Okay bestie, welcome to RFC 8313! 💖 Part 1 of 9, so buckle up 🎀
RFC 8313: Use of Multicast across Inter-domain Peering Points ✨
Okay so the header is giving a lot of key info 💅 This is RFC 8313, and it's a Best Current Practice, which the header tags as BCP 213. It's published under ISSN 2070-1721 and dated January 2018 📅 The document is edited by P. Tarapore and T. Eckert, with R. Sayko (AT&T), G. Shepherd (Cisco), and R. Krishnan (SupportVectors) also credited as authors 🫶 Tarapore and Eckert are the editors, and Eckert is listed with Huawei. Also, the header doesn't list any obsoletes or updates, so it isn't replacing or changing another RFC in that list. Iconic behaviour 👑
Abstract
This document looks at using Source-Specific Multicast (SSM) across inter-domain peering points for a set of specific deployment scenarios 🦋 It has two goals: (1) describe how the setup process works for multicast-based delivery across administrative domains in those scenarios, and (2) document the supporting functionality that makes that process work 🌸
Status of This Memo
This memo documents an Internet Best Current Practice 🍓
This document is a product of the Internet Engineering Task Force (IETF) ✨ It represents the consensus of the IETF community, has been through public review, and was approved for publication by the Internet Engineering Steering Group (IESG) 🎀 If you want more info on BCPs, check Section 2 of RFC 7841.
For info on the current status of this document, any errata, and how to send feedback, go to https://www.rfc-editor.org/info/rfc8313 🧚
Copyright Notice
Copyright (c) 2018 IETF Trust and the persons identified as the document authors. All rights reserved. 💜
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as in effect on the date of publication. Please read these carefully, because they describe your rights and restrictions for this document 🙈 Code Components pulled out of this document must include the Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as described in the Simplified BSD License 🫶
Table of Contents
1. Introduction ....................................................4
2. Overview of Inter-domain Multicast Application Transport ........6
3. Inter-domain Peering Point Requirements for Multicast ...........7
3.1. Native Multicast ...........................................8
3.2. Peering Point Enabled with GRE Tunnel .....................10
3.3. Peering Point Enabled with AMT - Both Domains
Multicast Enabled .........................................12
3.4. Peering Point Enabled with AMT - AD-2 Not
Multicast Enabled .........................................14
3.5. AD-2 Not Multicast Enabled - Multiple AMT Tunnels
through AD-2 ..............................................16
4. Functional Guidelines ..........................................18
4.1. Network Interconnection Transport Guidelines ..............18
4.1.1. Bandwidth Management ...............................19
4.2. Routing Aspects and Related Guidelines ....................20
4.2.1. Native Multicast Routing Aspects ...................21
4.2.2. GRE Tunnel over Interconnecting Peering Point ......22
4.2.3. Routing Aspects with AMT Tunnels ...................22
4.2.4. Public Peering Routing Aspects .....................24
4.3. Back-Office Functions - Provisioning and Logging
Guidelines ................................................26
4.3.1. Provisioning Guidelines ............................26
4.3.2. Inter-domain Authentication Guidelines .............28
4.3.3. Log-Management Guidelines ..........................28
4.4. Operations - Service Performance and Monitoring
Guidelines ................................................30
4.5. Client Reliability Models / Service Assurance Guidelines ..32
4.6. Application Accounting Guidelines .........................32
5. Troubleshooting and Diagnostics ................................32
6. Security Considerations ........................................33
6.1. DoS Attacks (against State and Bandwidth) .................33
6.2. Content Security ..........................................35
6.3. Peering Encryption ........................................37
6.4. Operational Aspects .......................................37
7. Privacy Considerations .........................................39
8. IANA Considerations ............................................40
9. References .....................................................40
9.1. Normative References ......................................40
9.2. Informative References ....................................42
Acknowledgments ...................................................43
Authors' Addresses ................................................441. Introduction 🌈
Content and data from several kinds of apps (live video streaming and software downloads, for example) are a perfect match for multicast delivery 🎬 Multicast saves a ton of resources inside any given administrative domain, which is honestly so smart 🧠 End User (EU) demand for this content keeps growing, and it often means moving that content across administrative domains through inter-domain peering points 📈
The objectives of this document are twofold:
- Describe the technical process and set up guidelines for multicast-based delivery of application content or other data across inter-domain peering points, using a set of use cases (where "Use Case 3.1" matches Section 3.1, "Use Case 3.2" matches Section 3.2, and so on) 🦋
- Catalog all the required exchanges of information between the administrative domains needed to support multicast-based delivery. This lets operators kick off the processes they need to support inter-domain peering with multicast 🫶
The scope and assumptions for this document are as follows:
- Administrative Domain 1 (AD-1) sources content to one or more EUs in one or more Administrative Domain 2 (AD-2) entities. AD-1 and AD-2 want to use IP multicast so they can support large and growing EU populations, with as little duplicated traffic as possible crossing network links 🌸
- This document doesn't go into the case where EUs are the ones originating content. To support that extra service, it's recommended that some method (outside the scope of this document) be used to get content from EUs to the application in AD-1, so AD-1 can send the traffic out as IP multicast. From that point on, the descriptions here apply, except they aren't complete, since they don't cover the transport or operational aspects of the leg from the EU to AD-1 🍓
- This document also doesn't cover the case where AD-1 and AD-2 aren't directly connected and are instead linked through one or more other ADs (rather than a peering point) that act as transit providers. The cases here where tunnels are used between AD-1 and AD-2 can be applied to those scenarios, but SLA ("Service Level Agreement") control, for example, would be different. Extra issues will probably show up in those scenarios too. That topic is left for further study 🔮
- For the purposes of this document, the term "peering point" means a network connection ("link") between two administrative network domains that traffic is exchanged over. This is also called a Network-to-Network Interface (NNI). Unless noted otherwise, the peering point is assumed to be a private one, where the network connection is physically or virtually isolated and runs solely between AD-1 and AD-2 💜 The other case is a broadcast peering point, which is a common option at public Internet Exchange Points (IXPs). See Section 4.2.4 for more details 🧚
- AD-1 is enabled with native multicast. A peering point exists between AD-1 and AD-2 ⭐
- It's understood that several protocols are available for this purpose, including Protocol-Independent Multicast - Sparse Mode (PIM-SM) and Protocol-Independent Multicast - Source-Specific Multicast (PIM-SSM) [RFC7761], the Internet Group Management Protocol (IGMP) [RFC3376], and Multicast Listener Discovery (MLD) [RFC3810] 🎀
- As described in Section 2, the source IP address of the (so-called "(S,G)") multicast stream in the originating AD (AD-1) is known. Under this condition, PIM-SSM is beneficial, because it lets the receiver's upstream router send a join message directly to the source without needing an intermediate Rendezvous Point (RP). SSM also has an improved threat mitigation profile against attack, as described in [RFC4609]. So, for inter-domain peering, it's recommended that only SSM protocols be used. Setting up inter-domain peering for ASM (Any-Source Multicast) is out of scope for this document 🔥
- The rest of this document assumes that PIM-SSM and BGP are used across the peering point, plus Automatic Multicast Tunneling (AMT) [RFC7450] and/or Generic Routing Encapsulation (GRE), depending on the scenario in question. Using other protocols is beyond the scope of this document 👑
- AMT is set up at the peering point if either the peering point or AD-2 isn't multicast enabled. It's assumed that an AMT relay will be available to a client for multicast delivery. Picking the optimal AMT relay for a client is out of scope for this document. Note that AMT is only necessary when native multicast isn't available at the peering point (Use Case 3.3), or in the downstream administrative domain (Use Cases 3.4 and 3.5) 😭
- It's assumed that billing data is collected at the application level and isn't treated as a networking issue. The settlements process for EU billing and/or inter-provider billing is out of scope for this document 💅
- Inter-domain network connectivity troubleshooting is only considered within the context of a cooperative process between the two domains 🌸
This document also tries to identify ways the peering process could be improved. Developing new methods for that improvement is beyond the scope of this document 🦋
2. Overview of Inter-domain Multicast Application Transport ✨
okay so here's the big picture 🦋 a multicast-based app delivery setup looks like this:
- Two independent administrative domains get connected through a peering point 🌸
- That peering point is either multicast enabled (end-to-end native multicast across both domains) or connected by one of two tunnel types:
- A service provider controls one or more application sources in AD-1. They'll send multicast IP packets over one or more (S,G)s, which are multicast traffic flows. (If IP multicast is new to you, check out Section 4.2.1 first, bestie 🧚.) It's assumed the service is a good fit for multicast, like live video of popular events or software downloads to lots of devices, and that the streams will ride on a suitable multicast transport protocol 💖
- An EU (end user) has a device connected to AD-2, running an application client that works with the service provider's application source 💅
- The application client joins the right (S,G)s to get the data it needs to deliver the service to the EU. How the client figures out which (S,G)s to join is an implementation detail of the application and is out of scope for this document 🙈
The core assumption here is that AD-1 has ultimate responsibility for delivering the multicast-based service on behalf of the content source(s). Every relevant interaction between the two domains in this document is built on that assumption ✨
Also, AD-2 can be an independent network domain, like a Tier 1 network operator domain 👑. Or it can be an enterprise network domain run by a single customer of AD-1 🎀 In that case, the peering point architecture and requirements can have some unique enterprise-network stuff going on, so check Section 3 for that.
The use cases for different multicast distribution setups, plus their requirements, live in Section 3 🦋 And Section 4 is the comprehensive list of info the two domains need to swap in order to support the functions that enable application transport. Iconic organization, honestly 😭
3. Inter-domain Peering Point Requirements for Multicast
ngl this section is where things get real. Running applications over multicast requires that the inter-domain peering point be enabled to support that process 🔥 Five use cases are presented for you to consider 💜
3.1. Native Multicast
okay this is the dream scenario 🌈 It's end-to-end native multicast between the two administrative domains, and the peering point is native multicast enabled too. Check out Figure 1 ✨
------------------- -------------------
/ AD-1 \ / AD-2 \
/ (Multicast Enabled) \ / (Multicast Enabled) \
/ \ / \
| +----+ | | |
| | | +------+ | | +------+ | +----+
| | AS |------>| BR |-|---------|->| BR |-------------|-->| EU |
| | | +------+ | I1 | +------+ |I2 +----+
\ +----+ / \ /
\ / \ /
\ / \ /
------------------- ------------------- AD = Administrative Domain (independent autonomous system)
AS = multicast (e.g., content) Application Source
BR = Border Router
I1 = AD-1 and AD-2 multicast interconnection (e.g., MP-BGP)
I2 = AD-2 and EU multicast connectionFigure 1: Content Distribution via End-to-End Native Multicast
Why this setup is giving 💅
- It's the most efficient use of bandwidth in both domains 🔥
- There are fewer devices in the path the multicast stream travels compared to an AMT-enabled peering point 🦋
Now the tea ☕ From AD-1's point of view, the one downside of native multicast to AD-2 (versus individual unicast to every EU in AD-2) is that AD-1 can't count how many EUs there are or how many bytes got delivered to them 🙈 That info matters for customer billing and operational logs. It's assumed the application layer will collect that data. The application-layer mechanisms for generating this info need to be robust enough that all pertinent requirements for the source provider and the AD operator are satisfactorily met. The specifics of those methods are beyond the scope of this document 🫶
Architectural guidelines for this configuration:
a. Dual homing for peering points between domains is recommended as a way to ensure reliability with full BGP table visibility 💖
b. If the peering point between AD-1 and AD-2 is a controlled network environment, the two domains can allocate bandwidth accordingly to permit the transit of non-rate-adaptive multicast traffic. If that's not the case, then the multicast traffic must support congestion control via any of the mechanisms described in Section 4.1 of [BCP145] ✨
c. Sending and receiving multicast traffic between two domains is typically decided by each domain's local policies 👑 For example, if AD-1 is a service provider and AD-2 is an enterprise, AD-1 may support local policies for delivering traffic to AD-2 but not receiving traffic from it. Another example is a policy where AD-1 delivers specified content to AD-2 only if that delivery has been accepted by contract 🌸
d. It's assumed that relevant information on multicast streams delivered to EUs in AD-2 is collected by the capabilities available in the application layer. The precise nature and formats of the collected information will be determined by directives from the source owner and the domain operators 🧚
3.2. Peering Point Enabled with GRE Tunnel
plot twist 🙈 The peering point is not native multicast enabled in this use case. Instead, a GRE tunnel is provisioned over the peering point. See Figure 2 💜
------------------- -------------------
/ AD-1 \ / AD-2 \
/ (Multicast Enabled) \ / (Multicast Enabled) \
/ \ / \
| +----+ +---+ | (I1) | +---+ |
| | | +--+ |uBR|-|--------|-|uBR| +--+ | +----+
| | AS |-->|BR| +---+-| | +---+ |BR| -------->|-->| EU |
| | | +--+<........|........|........>+--+ |I2 +----+
\ +----+ / I1 \ /
\ / GRE \ /
\ / Tunnel \ /
------------------- ------------------- AD = Administrative Domain (independent autonomous system)
AS = multicast (e.g., content) Application Source
uBR = unicast Border Router - not necessarily multicast enabled;
may be the same router as BR
BR = Border Router - for multicast
I1 = AD-1 and AD-2 multicast interconnection (e.g., MP-BGP)
I2 = AD-2 and EU multicast connection Figure 2: Content Distribution via GRE TunnelIn this case, interconnection I1 between AD-1 and AD-2 (see Figure 2) is multicast enabled through a GRE tunnel [RFC2784] between the two BRs, which encapsulates the multicast protocols across it ✨
This approach is usually picked if the uBR physically connected to the peering link cannot, or should not, be enabled for IP multicast 🎀 It can also be useful if the BR and uBR are the same device but the peering link is a broadcast domain (IXP). See Section 4.2.4 for that one 🦋
The routing configuration is basically unchanged 💅 Instead of running BGP (SAFI-2) ("SAFI" stands for "Subsequent Address Family Identifier") across the native IP multicast link between AD-1 and AD-2, BGP (SAFI-2) now runs across the GRE tunnel 🫶
Why this setup slaps:
- It's highly efficient use of bandwidth in both domains, though not as efficient as the fully native multicast use case (Section 3.1) 🔥
- There are fewer devices in the path the multicast stream travels compared to an AMT-enabled peering point 🌈
- It supports partial and/or incremental IP multicast deployments in AD-1 and/or AD-2 💖 Only the path or paths between the AS/BR (AD-1) and the BR/EU (AD-2) need to be multicast enabled. The uBRs may not support IP multicast, or enabling it could be seen as operationally risky on that important edge node. Dedicated BR nodes for IP multicast may (at least initially) be more acceptable 👑 The BR can also be placed so that only parts of the domain need native IP multicast support. For example, only the core in AD-1 but not the edge networks toward the uBR 🧚
- GRE is an existing technology and is relatively simple to implement 🌸
The not-so-slay parts 🙈
- Per Use Case 3.1, current router technology cannot count the number of EUs or the number of bytes transmitted 💀
- The GRE tunnel requires manual configuration 😭
- The GRE tunnel must be established prior to starting the stream 😭
- The GRE tunnel is often left pinned up 💀
Architectural guidelines for this configuration include the following. Guidelines (a) through (d) are the same as those in Use Case 3.1, and there are two more:
e. GRE tunnels are typically configured manually between peering points to support multicast delivery between domains 🎀
f. It is recommended that the GRE tunnel (tunnel server) configuration in the source network only advertises the routes to the application sources, and not to the entire network. This practice prevents unauthorized delivery of applications through the tunnel. For example, that could happen if the application (e.g., content) isn't part of an agreed-upon inter-domain partnership 🔥 This is the kind of detail that keeps everyone's content locked down, periodt 💜
3.3. Peering Point Enabled with AMT - Both Domains Multicast Enabled ✨
okay bestie, this one is a whole vibe 🦋 Both admin domains are native multicast enabled, but the peering point itself is not. 💅
The peering point gets AMT 🫶 The basic setup is in Figure 3:
------------------- -------------------
/ AD-1 \ / AD-2 \
/ (Multicast Enabled) \ / (Multicast Enabled) \
/ \ / \
| +----+ +---+ | I1 | +---+ |
| | | +--+ |uBR|-|--------|-|uBR| +--+ | +----+
| | AS |-->|AR| +---+-| | +---+ |AG| -------->|-->| EU |
| | | +--+<........|........|........>+--+ |I2 +----+
\ +----+ / AMT \ /
\ / Tunnel \ /
\ / \ /
------------------- -------------------
AD = Administrative Domain (independent autonomous system)
AS = multicast (e.g., content) Application Source
AR = AMT Relay
AG = AMT Gateway
uBR = unicast Border Router - not multicast enabled;
also, either AR = uBR (AD-1) or uBR = AG (AD-2)
I1 = AMT interconnection between AD-1 and AD-2
I2 = AD-2 and EU multicast connection
Figure 3: AMT Interconnection between AD-1 and AD-2Here's what's so good about it 🌸
- Highly efficient use of bandwidth in AD-1. 🔥
- AMT is an existing technology and is relatively simple to implement. Attractive properties of AMT include the following:
- Dynamic interconnection between the gateway-relay pair across the peering point. ✨
- Ability to serve clients and servers with differing policies. 💜
Now for the not-so-iconic parts 😭
- Per Use Case 3.1 (AD-2 is native multicast), current router technology cannot count the number of EUs or the number of bytes transmitted to all EUs. 💀
- Additional devices (AMT gateway and relay pairs) may be introduced into the path if these services are not incorporated into the existing routing nodes. 🙈
- Currently undefined mechanisms for the AG to automatically select the optimal AR. 🥲
Architecture-wise, the guidelines go like this 🎀 Guidelines (a) through (d) are the same as those described in Use Case 3.1. In addition,
e. It is recommended that AMT relay and gateway pairs be configured at the peering points to support multicast delivery between domains. AMT tunnels will then configure dynamically across the peering points once the gateway in AD-2 receives the (S,G) information from the EU. 🧚
3.4. Peering Point Enabled with AMT - AD-2 Not Multicast Enabled 🌈
In this AMT use case, AD-2 is not multicast enabled. So the interconnection between AD-2 and the EU isn't multicast enabled either. 🙃 Figure 4 shows the whole thing:
------------------- -------------------
/ AD-1 \ / AD-2 \
/ (Multicast Enabled) \ / (Not Multicast \
/ \ / Enabled) \ N(large)
| +----+ +---+ | | +---+ | # EUs
| | | +--+ |uBR|-|--------|-|uBR| | +----+
| | AS |-->|AR| +---+-| | +---+ ................>|EU/G|
| | | +--+<........|........|........... |I2 +----+
\ +----+ / N x AMT\ /
\ / Tunnel \ /
\ / \ /
------------------- -------------------
AS = multicast (e.g., content) Application Source
uBR = unicast Border Router - not multicast enabled;
otherwise, AR = uBR (in AD-1)
AR = AMT Relay
EU/G = Gateway client embedded in EU device
I2 = AMT tunnel connecting EU/G to AR in AD-1 through
non-multicast-enabled AD-2
Figure 4: AMT Tunnel Connecting AD-1 AMT Relay and EU GatewayBasically, this use case works like unicast distribution of the app through AD-2 🥹 The total number of AMT tunnels equals the total number of EUs asking for the app, so the peering point has to handle all those AMT tunnels between the two domains. Each AMT tunnel can carry the data usage for its own EU. 📊
Why it's cute 🦋
- Efficient use of bandwidth in AD-1 (the closer the AR is to the uBR, the more efficient). 💖
- Ability of AD-1 to introduce content delivery based on IP multicast, without any support by network devices in AD-2: only the application side in the EU device needs to perform AMT gateway library functionality to receive traffic from the AMT relay. 🧠✨
- Allows AD-2 to "upgrade" to Use Case 3.5 (see Section 3.5) at a later time, without any change in AD-1 at that time. 🆙
- AMT is an existing technology and is relatively simple to implement. Attractive properties of AMT include the following:
- Dynamic interconnection between the AMT gateway-relay pair across the peering point. 💫
- Ability to serve clients and servers with differing policies. 👑
- Each AMT tunnel serves as a count for each EU and is also able to track data usage (bytes) delivered to the EU. 🔢
The not-so-cute bits 😬
- Additional devices (AMT gateway and relay pairs) are introduced into the transport path. 🚧
- Assuming multiple peering points between the domains, the EU gateway needs to be able to find the "correct" AMT relay in AD-1. 🗺️
Guidelines, bestie 🎀 Guidelines (a) through (c) are the same as those described in Use Case 3.1. In addition,
d. It is necessary that proper procedures be implemented such that the AMT gateway at the EU device is able to find the correct AMT relay for each (S,G) content stream. Standard mechanisms for that selection are still subject to ongoing work. This includes the use of anycast gateway addresses, anycast DNS names, or explicit configuration that maps (S,G) to a relay address; or letting the application in the EU/G provide the relay address to the embedded AMT gateway function. 🧭
e. The AMT tunnel's capabilities are expected to be sufficient for the purpose of collecting relevant information on the multicast streams delivered to EUs in AD-2. 📈
3.5. AD-2 Not Multicast Enabled - Multiple AMT Tunnels through AD-2 🌷
Figure 5 is a twist on Use Case 3.4 💅
------------------- -------------------
/ AD-1 \ / AD-2 \
/ (Multicast Enabled) \ / (Not Multicast \
/ +---+ \ (I1) / +---+ Enabled) \
| +----+ |uBR|-|--------|-|uBR| |
| | | +--+ +---+ | | +---+ +---+ | +----+
| | AS |-->|AR|<........|.... | +---+ |AG/|....>|EU/G|
| | | +--+ | ......|.|AG/|..........>|AR2| |I3 +----+
\ +----+ / I1 \ |AR1| I2 +---+ /
\ / Single \+---+ /
\ / AMT Tunnel \ /
------------------- -------------------
uBR = unicast Border Router - not multicast enabled;
also, either AR = uBR (AD-1) or uBR = AGAR1 (AD-2)
AS = multicast (e.g., content) Application Source
AR = AMT Relay in AD-1
AGAR1 = AMT Gateway/Relay node in AD-2 across peering point
I1 = AMT tunnel connecting AR in AD-1 to gateway in AGAR1 in AD-2
AGAR2 = AMT Gateway/Relay node at AD-2 network edge
I2 = AMT tunnel connecting relay in AGAR1 to gateway in AGAR2
EU/G = Gateway client embedded in EU device
I3 = AMT tunnel connecting EU/G to AR in AGAR2
Figure 5: AMT Tunnel Connecting AMT Gateways and RelaysUse Case 3.4 ends up with a bunch of long AMT tunnels crossing the whole AD-2 network, linking the EU device and the AMT relay in AD-1 through the peering point 😩 Depending on how many EUs there are, you can get an unacceptably high amount of traffic from all those AMT tunnels (and unicast streams) through the peering point. Here's how to fix that 🛠️✨
- Provisioning of strategically located AMT nodes in AD-2. An AMT node is a co-located AMT gateway and AMT relay. AD-1 doesn't need to change anything compared to Use Case 3.4. AD-2 can do this whenever it sees fit (e.g., too much traffic across the peering point). 🏗️
- One such node is on the AD-2 side of the peering point (AMT node AGAR1 in Figure 5). 📍
- A single AMT tunnel established across the peering point linking the AMT relay in AD-1 to the AMT gateway in AMT node AGAR1 in AD-2. 🔗
- AMT tunnels linking AMT node AGAR1 at the peering point in AD-2 to other AMT nodes located at the edges of AD-2: e.g., AMT tunnel I2 linking the AMT relay in AGAR1 to the AMT gateway in AMT node AGAR2 (Figure 5). 🌐
- AMT tunnels linking an EU device (via a gateway client embedded in the device) and an AMT relay in an appropriate AMT node at the edge of AD-2: e.g., I3 linking the EU gateway in the device to the AMT relay in AMT node AGAR2. 🎯
- In the simplest option (not shown), AD-2 only deploys a single AGAR1 node and lets the EU/G build AMT tunnels directly to it. This setup already solves the problem of replicated traffic across the peering point. As soon as there's a need to support more AMT tunnels to the EU/G, AD-2 can deploy additional AGAR2 nodes. 🌱
So the upside of this chained set of AMT tunnels is that the total number of unicast streams across AD-2 drops a lot, which frees up bandwidth 🫧 There's also just a single unicast stream across the peering point, instead of possibly an unacceptably large number of them like in Use Case 3.4. The catch is that several AMT tunnels have to be configured dynamically by the various AMT gateways, based only on the (S,G) information the application client at the EU device sends. So a suitable mechanism for those dynamic configurations is critical 😤🔐
Architectural guidelines for this configuration are as follows 🎀 Guidelines (a) through (c) are the same as those described in Use Case 3.1. In addition,
d. It is necessary that proper procedures be implemented such that the various AMT gateways (at the EU devices and the AMT nodes in AD-2) are able to find the correct AMT relay in other AMT nodes as appropriate. Standard mechanisms for that selection are still subject to ongoing work. This includes the use of anycast gateway addresses, anycast DNS names, or explicit configuration that maps (S,G) to a relay address. On the EU/G, this mapping information may come from the application. 🗂️
e. The AMT tunnel's capabilities are expected to be sufficient for the purpose of collecting relevant information on the multicast streams delivered to EUs in AD-2. 📊💖
4. Functional Guidelines ✨
Okay bestie, this is where we get into the good stuff 💅 This section lists the supporting functions and interfaces over the peering point that make multicast transport of the application actually work 🫶 It also covers the critical information parameters that need to be exchanged to support them, with guidelines where they help. Here's the lineup:
4.1. Network Interconnection Transport Guidelines
"Network interconnection transport" is just the fancy term for the interconnection points between the two administrative domains 🌸 Here's a representative set of attributes that the two ADs will need to agree on to support multicast delivery 💖
- Number of peering points.
- Peering point addresses and locations.
- Connection type: dedicated for multicast delivery, or shared with other services.
- Connection mode: direct connectivity between the two ADs, or via another ISP.
- Peering point protocol support: the multicast protocols used for multicast delivery need to be supported at these points. Examples include External BGP (EBGP) [RFC4760] peering via MP-BGP (Multiprotocol BGP) SAFI-2 [RFC4760].
- Bandwidth allocation: if the connection is shared with other services, you need to figure out how much bandwidth is reserved for multicast delivery. See Section 4.1.1 below for more details 🦋
- QoS requirements: delay and/or latency specs that need to be written into an SLA ⏱️
- AD roles and responsibilities: the role each AD plays in provisioning and maintaining the set of peering points that support multicast delivery 👑
4.1.1. Bandwidth Management
Okay, this one is a whole vibe 😭 Like IP unicast traffic, IP multicast traffic carried across non-controlled networks has to play nice with congestion control principles, as described in [BCP41] and explained in detail for UDP IP multicast in [BCP145] 🫶
Non-controlled networks (think the Internet) are networks with no policy for managing bandwidth beyond best effort, with a fair share of bandwidth under congestion. As a simplified rule of thumb, following congestion control principles means reducing your bandwidth under congestion in a way that's fair to competing flows (typically TCP), which is what we call "rate adaptive" 💜
Here's the thing: multicast content usually starts life inside an intra-domain deployment, where it's treated as a controlled network service and doesn't follow congestion control principles. It got a reserved chunk of bandwidth and was admitted to the network so congestion never happens. So when you evolve to an inter-domain peering deployment, the congestion control issue should be given specific attention 🙈
When end-to-end IP multicast traffic passes across the networks of two ADs (and their subsidiaries and customers), both ADs must agree on a consistent traffic-management policy. Say AD-1 sources non-congestion-aware IP multicast traffic, and AD-2 carries it as best-effort traffic across links shared with other Internet traffic that's subject to congestion. Yeah, that will not work 💀 Under congestion, some of that traffic gets dropped, and the leftover packets often become undecodable garbage clogging up the network in AD-2. Since this traffic isn't congestion aware, the loss doesn't reduce its rate. Competing traffic doesn't get its fair share under congestion, and EUs get frustrated by the extremely bad quality of both their IP multicast traffic and their other (e.g., TCP) traffic 😭
Now, this isn't an IP multicast technology issue. It's purely a transport-layer and application-layer issue. The same problem would just as likely happen if AD-1 sent non-rate-adaptive unicast traffic, like legacy IPTV video-on-demand traffic, which is also typically non-congestion aware. That said, rate adaptation in IP unicast video is everywhere today thanks to ABR (Adaptive Bitrate) video, so it's very unlikely this happens with IP unicast in reality ✨
The traffic management rules apply whether or not IP multicast is tunneled. But the one feature that can make AMT tunnels trickier is how unpredictable the bandwidth requirements on underlying links are, because of the way they get used. With native IP multicast or GRE tunnels, the bandwidth depends on the amount of content, not the number of EUs, so it's easier to plan for 🍓 AMT tunnels terminating in the EU/G, on the other hand, scale with the number of EUs. Near the AMT relay, they can introduce a very large amount of replicated traffic, and it's not always feasible to provision enough bandwidth for every possible EU to get the highest quality for all their content during peak utilization. The exception is when the AMT relays are very close to the EU edge. So, even inside controlled networks, it's also recommended that IP multicast rate adaptation be used when AMT tunnels go directly to the EU/G 🌈
Quick heads-up: rate-adaptive IP multicast doesn't mean the sender is lowering its bitrate. It means the EUs experiencing congestion are joining a lower-bitrate (S,G) stream of the content, kind of like ABR streaming over TCP 🎀 So if you migrate from a non-rate-adaptive bitrate to a rate-adaptive one in IP multicast, the dynamic (S,G) join behavior in the network changes too. That can mean higher performance requirements for IP multicast protocols (IGMP/PIM), especially on the last hops where dynamic changes happen (including AMT gateways and relays). In non-rate-adaptive IP multicast, only a "channel change" causes a state change. In rate-adaptive multicast, congestion causes state changes too ⭐
Even though it's not fully specified in this document, peerings that rely on GRE or AMT tunnels may cross one or more transit ADs instead of an exclusive (non-shared, L1/L2) path. Unless those transit ADs are explicitly contracted to provide something other than "best effort" transit for the tunneled traffic, the tunneled IP multicast traffic must be rate adaptive so it doesn't violate BCP 41 across those transit ADs 🧚
4.2. Routing Aspects and Related Guidelines
The main objective for multicast delivery routing is to make sure the EU receives the multicast stream from the "most optimal" source [INF_ATIS_10]. That typically means:
- Maximizing the multicast portion of the transport and minimizing any unicast portion of the delivery, and
- Minimizing the overall combined route distance of the network(s).
This routing objective applies to both native multicast and AMT. The actual methodology of the solution will be different for each one 🦋 Either way, the routing solution is expected to:
- Be scalable,
- Avoid or minimize new protocol development or modifications, and
- Be robust enough to achieve high reliability and to automatically adjust to changes and problems in the multicast infrastructure.
For both native and AMT environments, having a source as close as possible to the EU network is most desirable. So in some cases, an AD may prefer to have multiple sources near different peering points. However, that's entirely an implementation issue 💅
4.2.1. Native Multicast Routing Aspects
Native multicast just requires that the administrative domains coordinate and advertise the correct source address(es) at their network interconnection peering points (i.e., BRs). Here's an example of multicast delivery via a native multicast process across two administrative domains, assuming the interconnecting peering points are also multicast enabled 🌸
- The EU client, who is a subscriber to AD-2 (see Use Case 3.1), gets the appropriate information. This info is in the form of metadata, and it contains instructions telling the EU client to launch an appropriate application if necessary. It also includes extra info for the application about the source location and the group (or stream) ID, in the form of
(S,G)data. The "S" portion provides the name or IP address of the source of the multicast stream. The metadata may also contain alternate delivery information, like the unicast address of the stream 🎀 - The client uses the join message with
(S,G)to join the multicast stream [RFC4604]. To make this work, the two ADs need to do the following:- Advertise the source ID(s) over the peering points.
- Exchange relevant peering point information, such as capacity and utilization.
- Implement compatible multicast protocols to ensure proper multicast delivery across the peering points ✨
4.2.2. GRE Tunnel over Interconnecting Peering Point
If the interconnecting peering point isn't multicast enabled but both ADs are, then a simple solution is to provision a GRE tunnel between the two ADs. See Use Case 3.2 (Section 3.2) 🧚 Where the tunnel terminates is usually a network engineering decision, but it generally sits between the BRs, or even between the AD-2 BR and the AD-1 source (or source access router). The GRE tunnel allows end-to-end native multicast or AMT multicast to traverse the interface. Coordination and advertisement of the source IP are still required 🫶
The two ADs need to follow the same process described in Section 4.2.1 to facilitate multicast delivery across the peering points 💜
4.2.3. Routing Aspects with AMT Tunnels 🦋
Okay so, unlike native multicast (with or without GRE), AMT multicast is lowkey way more complicated 😭 It's a two-layered problem because there are two criteria that should be met at the same time:
- Find the closest AMT relay to the EU that also has multicast connectivity to the content source, and
- Minimize the AMT unicast tunnel distance.
There are basically two components in the AMT specification 💜
- AMT relays: These do the job of tunneling UDP multicast traffic to the receivers (aka the endpoints) ✨ The AMT relay pulls the traffic natively from the multicast media source, then replicates the stream for the downstream AMT gateways. It wraps the multicast packets into unicast packets and sends them over the tunnel toward the AMT gateways. The AMT relay may also collect various usage and activity statistics 📊 The replication point moves closer to the EU and cuts down on traffic across the network, which means the linear costs of adding unicast subscribers can be avoided 🙌 Still, unicast replication is required for each requesting endpoint within the unicast-only network 💀
- AMT gateway: The gateway lives on an endpoint, and that could be any type of IP host, like a Personal Computer (PC), mobile phone, Set-Top Box (STB), or appliances 📺 The gateway receives join and leave requests from the application via an Application Programming Interface (API), so the endpoint can act like a true multicast endpoint 🎀 It encapsulates AMT messages into UDP packets and sends them through a tunnel (across the unicast-only infrastructure) to the AMT relay.
The simplest AMT use case (Section 3.3) is giving peering points that are not multicast enabled between two multicast-enabled ADs a glow-up 💖 An AMT tunnel is deployed between an AMT relay on the AD-1 side of the peering point and an AMT gateway on the AD-2 side. The best part is that the tunnel is set up on an as-needed basis, so it doesn't need to be a provisioned element ✨ The two ADs can coordinate and advertise special AMT relay anycast addresses with, and to, each other 🤝 Or they can just provision relay addresses, though that wouldn't be an optimal solution in terms of scalability 🙈
Use Cases 3.4 and 3.5 are the messier situations, since AD-2 is not multicast enabled in these two cases 😩 Here the EU device needs to be able to set up an AMT tunnel in the most optimal manner. There are many methods for relay selection, including DNS-based queries and static lookup tables [RFC7450]. The choice of method is implementation dependent and is up to the network operators 🧚 Comparing the various methods is out of scope for this document and is left for further study.
Here's an illustrative example of relay selection based on DNS queries as part of an anycast IP address process, for Use Cases 3.4 and 3.5 (Sections 3.4 and 3.5). Using an anycast IP address for AMT relays lets all AMT gateways find the "closest" AMT relay, which is the nearest edge of the multicast topology of the source 🌈 This is strictly illustrative, so the choice of method is still up to the network operators. The basic process goes like this:
- The EU client application gets the appropriate metadata. The metadata contains instructions that point the EU client to an ordered list of particular destinations to seek the requested stream. For multicast, it also specifies the source location and the group (or stream) ID in the form of
(S,G)data. The "S" portion gives the URI (name or IP address) of the source of the multicast stream, and the "G" identifies the particular stream originated by that source. The metadata may also carry alternate delivery information, such as the address of the unicast form of the content to be used (for example, if the multicast stream becomes unavailable) 🎁 - Using the information from the metadata and, possibly, information provisioned directly in the EU client, a DNS query is initiated to connect the EU client / AMT gateway to an AMT relay 🔍
- The query results are obtained and may return an anycast address or a specific unicast address of a relay. Multiple relays will typically exist. The anycast address is a routable "pseudo-address" shared among the relays that can gain multicast access to the source 👑
- If a specific IP address unique to a relay was not obtained, the AMT gateway sends a message (e.g., the discovery message) to the anycast address. That way the network makes the routing choice of a particular relay, such as the one closest to the EU. Details are outside the scope of this document. See [RFC4786] 🛰️
- The contacted AMT relay returns its specific unicast IP address, and after that the anycast address is no longer required. Variations may exist as well 💅
- The AMT gateway uses that unicast IP address to start a three-way handshake with the AMT relay 🫶
- The AMT gateway provides the
(S,G)information to the AMT relay (embedded in AMT protocol messages) 📨 - The AMT relay receives the
(S,G)information and uses it to join the appropriate multicast stream, if it hasn't already subscribed to that stream 🔥 - The AMT relay encapsulates the multicast stream into the tunnel between the relay and the gateway, delivering the requested content to the EU 🎀
4.2.4. Public Peering Routing Aspects 🌸
Let's look at a broadcast peering point, shown in Figure 6 💜
AD-1a AD-1b
BR BR
| |
--+-+---------------+-+-- broadcast peering point LAN
| |
BR BR
AD-2a AD-2b
Figure 6: Broadcast Peering PointA broadcast peering point is an L2 subnet connecting three or more ADs. It's super common at IXPs, and it usually consists of Ethernet switch(es) operated by the IXP connecting to BRs operated by the ADs 🌐
Here's an example setup 🎀 AD-2a peers with AD-1a and wants to receive IP multicast from it. Likewise, AD-2b peers with AD-1b and wants to receive IP multicast from it.
Now assume that one or more IP multicast (S,G) traffic streams can be served by both AD-1a and AD-1b, for example because both AD-1a and AD-1b pull this content from the same content source 😵💫
Here's the tricky part: AD-2a and AD-2b can no longer control which upstream domain (AD-1a or AD-1b) will forward this (S,G) into the LAN 😭 The AD-2a BR requests the (S,G) from the AD-1a BR, and the AD-2b BR requests the same (S,G) from the AD-1b BR. To avoid duplicate packets, an (S,G) can be forwarded by only one router onto the LAN. PIM-SM / PIM-SSM detects requests for duplicate transmissions and resolves them via the so-called "assert" protocol operation, which results in only one BR forwarding the traffic. Let's say that's the AD-1a BR. Then AD-2b receives unexpected multicast traffic from a provider it doesn't have a mutual agreement with for that traffic 🙈 Quality issues in EUs behind AD-2b caused by AD-1a will cause a lot of issues related to responsibility and troubleshooting 💀
With all these technical issues in mind, here are the options for how IP multicast can be carried across broadcast peering point LANs 🍓
- IP multicast is tunneled across the LAN. Any of the GRE/AMT tunneling solutions mentioned in this document are applicable. This is the one case where a GRE tunnel between the upstream BR (e.g., AD-1a) and downstream BR (e.g., AD-2a) is specifically recommended, as opposed to tunneling across uBRs (which are not the actual BRs) ✨
- The LAN has only one upstream AD sourcing IP multicast, and native IP multicast is used. This is an efficient way to distribute the same IP multicast content to multiple downstream ADs 🦋 Misbehaving downstream BRs can still disrupt the delivery of IP multicast from the upstream BR to other downstream BRs, so strict rules must be followed to prohibit such a case 🚫 The downstream BRs must ensure that they will always consider only the upstream BR as a source for multicast traffic. For example, there should be no BGP
SAFI-2peerings between the downstream ADs across the peering point LAN, so that the upstream BR is the only possible next hop reachable across this LAN. Also, routing policies can be configured to avoid falling back to usingSAFI-1(unicast) routes for IP multicast if unicast BGP peering is not limited in the same way 🔐 - The LAN has multiple upstream ADs, but they are federated and agree on a consistent policy for IP multicast traffic across the LAN 🤝 One policy is that each possible source is only announced by one upstream BR. Another policy is that sources are redundantly announced (the problematic case mentioned in the example in Figure 6 above), but the upstream domains also provide mutual operational insight to help with troubleshooting (outside the scope of this document) 🧠
4.3. Back-Office Functions - Provisioning and Logging Guidelines 🎀
"Back office" refers to the following:
- Servers and content-management systems that support the delivery of applications via multicast and interactions between ADs 💻
- Functionality associated with logging, reporting, ordering, provisioning, maintenance, service assurance, settlement, etc. 📋
4.3.1. Provisioning Guidelines 📦✨
okay so bestie, this is the part where we figure out what needs to be set up before anything can actually flow 💅 Resources for basic connectivity between the ADs' providers need to be provisioned as follows:
- Sufficient capacity MUST be provisioned to support multicast-based delivery across ADs. 🌸
- Sufficient capacity MUST be provisioned for connectivity between all supporting back offices of the ADs as appropriate. This includes activating proper security treatment for these back-office connections (gateways, firewalls, etc.) as appropriate. 🔥
Now the multicast-based inter-domain delivery stuff, which is giving main character energy 🦋 The ability to receive a requested application via multicast is triggered via receipt of the necessary metadata. So this metadata MUST be provided to the EU regarding the multicast URL -- and unicast fallback if applicable. AD-2 MUST enable the delivery of this metadata to the EU and provision appropriate resources for this purpose. 💜
It is assumed that native multicast functionality is available across many ISP backbones, peering points, and access networks. If, however, native multicast is not an option (Use Cases 3.4 and 3.5), then:
- The EU MUST have a multicast client to use AMT multicast obtained from either (1) the application source (per agreement with AD-1) or (2) AD-1 or AD-2 (if delegated by the application source). 🎀
- If provided by AD-1 or AD-2, then the EU could be redirected to a client download site. (Note: This could be an application source site.) If provided by the application source, then this source would have to coordinate with AD-1 to ensure that the proper client is provided (assuming multiple possible clients). 🧚
- Where AMT gateways support different application sets, all AD-2 AMT relays need to be provisioned with all source and group addresses for streams it is allowed to join. 🌈
- DNS across each AD must be provisioned to enable a client gateway to locate the optimal AMT relay (i.e., longest multicast path and shortest unicast tunnel) with connectivity to the content's multicast source. 🍓
Provisioning aspects related to operations and customer care are as follows. It is assumed that each AD provider will provision operations and customer care access to their own systems. ⭐
AD-1's operations and customer care functions MUST be able to see enough of what is happening in AD-2's network or in the service provided by AD-2 to verify their mutual goals and operations, e.g., to know how the EUs are being served. This can be done in two ways:
- Automated interfaces are built between AD-1 and AD-2 such that operations and customer care continue using their own systems. This requires coordination between the two ADs, with appropriate provisioning of necessary resources. 🫶
- AD-1's operations and customer care personnel are provided direct access to AD-2's systems. In this scenario, additional provisioning in these systems will be needed to provide necessary access. The two ADs MUST agree on additional provisioning to support this option. 💖
4.3.2. Inter-domain Authentication Guidelines 🔐
All interactions between pairs of ADs can be discovered and/or associated with the account(s) utilized for delivered applications. Supporting guidelines are as follows:
- A unique identifier is RECOMMENDED to designate each master account. 🦋
- AD-2 is expected to set up "accounts" (a logical facility generally protected by credentials such as login passwords) for use by AD-1. Multiple accounts, and multiple types or partitions of accounts, can apply, e.g., customer accounts, security accounts. 👑
The reason to specifically mention the need for AD-1 to initiate interactions with AD-2 (and use some account for that), as opposed to the opposite, is based on the recommended workflow initiated by customers (see Section 4.4): the customer contacts the content source, which is part of AD-1. Consequently, if AD-1 sees the need to escalate the issue to AD-2, it will interact with AD-2 using the aforementioned guidelines. 💅
4.3.3. Log-Management Guidelines 📝
Successful delivery (in terms of user experience) of applications or content via multicast between pairs of interconnecting ADs can be improved through the ability to exchange appropriate logs for various workflows -- troubleshooting, accounting and billing, optimization of traffic and content transmission, optimization of content and application development, and so on. 🌸
Specifically, AD-1 take over primary responsibility for customer experience on behalf of the content source, with support from AD-2 as needed. The application/content owner is the only participant who has, and needs, full insight into the application level and can map the customer application experience to the network traffic flows -- which, with the help of AD-2 or logs from AD-2, it can then analyze and interpret. 🔍
The main difference between unicast delivery and multicast delivery is that the content source can infer a lot more about downstream network problems from a unicast stream than from a multicast stream: the multicast stream is not per EU, except after the last replication, which is in most cases not in AD-1. Logs from the application, including the receiver side at the EU, can provide insight but cannot help to fully isolate network problems because of the IP multicast per-application operational state built across AD-1 and AD-2 (aka the (S,G) state and any other operational-state features, such as Diffserv QoS). 🧠
See Section 7 for more discussion regarding the privacy considerations of the model described here. 🔒
Different types of logs are known to help support operations in AD-1 when provided by AD-2. This could be done as part of AD-1/AD-2 contracts. Note that except for implied multicast-specific elements, the options listed here are not unique or novel for IP multicast, but they are more important for services novel to the operators than for operationally well-established services (such as unicast). We therefore detail them as follows:
- Usage information logs at an aggregate level. 📊
- Usage failure instances at an aggregate level. 🚨
- Grouped or sequenced application access: performance, behavior, and failure at an aggregate level to support potential application-provider-driven strategies. Examples of aggregate levels include grouped video clips, web pages, and software-download sets. 🎬
- Security logs, aggregated or summarized according to agreement (with additional detail potentially provided during security events, by agreement). 🛡️
- Access logs (EU), when needed for troubleshooting. 🔧
- Application logs ("What is the application doing?"), when needed for shared troubleshooting. 🤔
- Syslogs (network management), when needed for shared troubleshooting. 🧾
The two ADs MAY supply additional security logs to each other, as agreed upon in contract(s). Examples include the following:
- Information related to general security-relevant activity, which may be of use from a protection or response perspective: types and counts of attacks detected, related source information, related target information, etc. 🕵️♀️
- Aggregated or summarized logs according to agreement (with additional detail potentially provided during security events, by agreement). 💜
4.4. Operations - Service Performance and Monitoring Guidelines 📈
"Service performance" refers to monitoring metrics related to multicast delivery via probes. The focus is on the service provided by AD-2 to AD-1 on behalf of all multicast application sources (metrics MAY be specified for SLA use or otherwise). Associated guidelines are as follows:
- Both ADs are expected to monitor, collect, and analyze service performance metrics for multicast applications. AD-2 provides relevant performance information to AD-1; this enables AD-1 to create an end-to-end performance view on behalf of the multicast application source. ⭐
- Both ADs are expected to agree on the types of probes to be used to monitor multicast delivery performance. For example, AD-2 MAY permit AD-1's probes to be utilized in the AD-2 multicast service footprint. Alternately, AD-2 MAY deploy its own probes and relay performance information back to AD-1. 🧚
"Service monitoring" generally refers to a service (as a whole) provided on behalf of a particular multicast application source provider. It thus involves complaints from EUs when service problems occur. EUs direct their complaints to the source provider; the source provider in turn submits these complaints to AD-1. The responsibility for service delivery lies with AD-1; as such, AD-1 will need to determine where the service problem is occurring -- in its own network or in AD-2. It is expected that each AD will have tools to monitor multicast service status in its own network. 🍓
- Both ADs will determine how best to deploy multicast service monitoring tools. Typically, each AD will deploy its own set of monitoring tools, in which case both ADs are expected to inform each other when multicast delivery problems are detected. 🌈
- AD-2 may experience some problems in its network. For example, for the AMT use cases (Sections 3.3, 3.4, and 3.5), one or more AMT relays may be experiencing difficulties. AD-2 may be able to fix the problem by rerouting the multicast streams via alternate AMT relays. If the fix is not successful and multicast service delivery degrades, then AD-2 needs to report the issue to AD-1. 🦋
- When a problem notification is received from a multicast application source, AD-1 determines whether the cause of the problem is within its own network or within AD-2. If the cause is within AD-2, then AD-1 supplies all necessary information to AD-2. Examples of supporting information include the following:
- Kind(s) of problem(s). 🐛
- Starting point and duration of problem(s). ⏰
- Conditions in which one or more problems occur. 🌦️
- IP address blocks of affected users. 🗺️
- ISPs of affected users. 🏢
- Type of access, e.g., mobile versus desktop. 📱
- Network locations of affected EUs. 📍
- Both ADs conduct some form of root-cause analysis for multicast service delivery problems. Examples of various factors for consideration include:
- Verification that the service configuration matches the product features. ✅
- Correlation and consolidation of the various customer problems and resource troubles into a single root-service problem. 🧩
- Prioritization of currently open service problems, giving consideration to problem impacts, SLAs, etc. 🥇
- Conducting service tests, including tests performed once or a series of tests over a period of time. 🧪
- Analysis of test results. 📋
- Analysis of relevant network fault or performance data. 💾
- Analysis of the problem information provided by the customer. 🙋♀️
- Once the cause of the problem has been determined and the problem has been fixed, both ADs need to work jointly to verify and validate the success of the fix. 🤝
4.5. Client Reliability Models / Service Assurance Guidelines ✨
okay so there are a bunch of ways to set up reliability architectures 🛠️ and honestly most of them live at the application level 💅 Both ADs should figure these options out together, based on their contract or agreement, and also with the multicast application source providers 🫶
Network reliability can also get a glow-up 🌟 if the two ADs provision alternate delivery mechanisms via unicast means. backup plans are everything, bestie 🦋
4.6. Application Accounting Guidelines
application-level accounting is giving "handle it differently" 💀 because it works another way than IP unicast does 🙈 The source side doesn't deliver packets straight to each individual receiver. So the receiver has to signal this back to the source instead ✨
For network transport diagnostics, AD-1 and AD-2 should have mechanisms in place 📊 to make sure accounting is proper for two things: the volume of bytes delivered through the peering point, and, separately, the number of bytes delivered to EUs 💖
5. Troubleshooting and Diagnostics 🔍
Any service provider that supports multicast delivery of content should be able to collect diagnostics as part of multicast troubleshooting practices 🕵️♀️ and resolve network issues accordingly. Issues can become apparent or identifiable in one of two ways: (1) network monitoring functions, or (2) problems reported by customers, as described in Section 4.4 📞
It is recommended that multicast diagnostics be performed 🌸 leveraging established operational practices, like the ones documented in [MDH-05]. BUT, since inter-domain multicast creates a seriously big interdependence of proper networking functionality between providers 🥺, providers need a way to signal (or otherwise alert) each other if either one notices any issues. communication is the main character here 🎀
For troubleshooting purposes, service providers may also wish to allow limited read-only administrative access to their routers for their AD peers 🔐 Access to active troubleshooting tools is of specific interest, especially [Traceroute] and the tools discussed in [Mtrace-v2] 👀
Another option is to put this functionality inside the IP multicast receiver application on the EU device 📱 and let support operations use these diagnostics remotely 🧚 Just note that AMT does not allow the passing of traceroute or mtrace requests 😭 So troubleshooting with AMT in the mix doesn't work as well end to end as it does with native (or even GRE-encapsulated) IP multicast, especially for traceroute and mtrace. Troubleshooting directly on the actual network devices is then more likely necessary 🛠️
⚠️ AMT can be a sneaky blocker here. If the traceroute and mtrace requests can't get through, plan on checking the actual network devices directly.
The specifics of notifications and alerts are beyond the scope of this document 📝 but the general guidelines are similar to the ones in Section 4.4. Some general communications issues are as follows 💅
- Appropriate communications channels will be established between the customer service and operations groups from both ADs 🤝 to keep information flowing for diagnostic troubleshooting.
- A default resolution period may be considered to resolve open issues ⏰ Alternately, mutually acceptable resolution periods could be established, depending on the severity of the identified trouble 🚨
6. Security Considerations 🔐
6.1. DoS Attacks (against State and Bandwidth) 💀
okay this part is serious, bestie 😤 Reliable IP multicast operations need some basic protection against DoS (Denial of Service) attacks 🛡️
SSM IP multicast is self-protecting against attacks from illicit sources 🙌 Such traffic will not be forwarded beyond the first-hop router, because that would require (S,G) membership reports from the receiver. Only valid traffic from sources gets forwarded, because RPF ("Reverse Path Forwarding") is part of the protocols ✨ So you could say that protection against spoofed source traffic, done in the style of [BCP38], is built right into PIM-SM / PIM-SSM 🦋
Receivers can attack SSM IP multicast by originating such (S,G) membership reports 😈 This can lead to a DoS attack against state, through the creation of a large number of (S,G) states. Those can create high control-plane load, or even stop a valid (S,G) from being created later 💀 If illicit sources are collaborating with them, it can also result in the forwarding of traffic from those illicit sources 🙈
Today, these types of attacks are usually mitigated by explicitly defining the set of permissible (S,G) on, for example, the last-hop routers that replicate IP multicast to EUs 🧱 (e.g., via (S,G) access control lists applied to IGMP/MLD membership state creation). Each AD (say, "ADi") is expected to know what sources located in ADi are permitted to send, and what their valid (S,G)s are 📋 ADi can therefore also filter invalid (S,G)s for any "S" located inside ADi, but not sources located in another AD 🚫
In the peering case, without further information, AD-2 is not aware of the set of valid (S,G) from AD-1 🫠 So this set needs to be communicated via operational procedures from AD-1 to AD-2 to protect against this type of DoS attack 🤝 Future work could signal this information in an automated way: through BGP extensions, DNS resource records, or backend automation between AD-1 and AD-2 🤖 Backend automation is, in the short term, the most viable solution. Unlike BGP extensions or DNS resource records, backend automation does not require router software extensions 💜 Observing traffic flowing via (S,G) state could also be used to automate the recognition of invalid (S,G) state created by receivers, in the absence of explicit information from AD-1 👀
The second type of DoS attack through (S,G) membership reports exists when the attacking receiver creates too much valid (S,G) state, and the traffic carried by these (S,G)s congests bandwidth on links shared with other EUs 🚦 Picture the uplink to a last-hop router connecting to 100 EUs. If one EU joins more multicast content than fits into this link, that also hurts the quality of the same content for the other 99 EUs 😭 If the traffic is not rate adaptive, the effects are even worse 💀
The mitigation technique is the same as what is often used for unicast: policing the per-EU total amount of traffic 🎀 Unlike unicast, though, this cannot be done anywhere along the path (e.g., on an arbitrary bottleneck link). It has to happen at the point of last replication to the different EUs 📍 Simple solutions, such as limiting the maximum number of joined (S,G)s per EU, are readily available. Solutions that take consumed bandwidth into account are available as vendor-specific features in routers 🧠 Note that this is primarily a non-peering issue in AD-2. It only becomes a peering issue if the peering link itself is not big enough to carry all possible content from AD-1 or, as in Use Case 3.4, when the AMT relay in AD-1 is that last replication point 🫶
Limiting the amount of (S,G) state per EU is also a good first measure to stop too much undesired "empty" state from being built (state not carrying traffic) 🧹 But it would not be enough in the case of DDoS attacks, e.g., viruses that impact a large number of EU devices 🦠💔
6.2. Content Security ✨
okay so content confidentiality, DRM (Digital Rights Management), authentication, and authorization are all optional 💅, and it depends on what content is being delivered. For content that's "FTA" (Free To Air) 📺, you can ignore the following considerations, so the content can be sent unencrypted and without EU authentication and authorization. Note though 🫶: the mechanisms described here may still be desirable for the application source so it can better track users, even if the content itself wouldn't need that.
For inter-domain content, there are at least two models for content confidentiality 🎀, covering (1) DRM authentication and authorization and (2) EU authentication and authorization:
- In the classical (IP)TV model 📺, responsibility is per domain, and content is and can be passed on unencrypted. AD-1 delivers content to AD-2, and AD-2 can further process it, including features like ad insertion. AD-2 is also the sole point of contact for its EUs. This document doesn't cover this case, because it usually involves service aspects that AD-2 runs above the network layer. This document focuses on the network-layer AD-1/AD-2 peering case, not the application-layer peering case. Still, this model can be derived through additional work beyond what's described here 💖.
- The other model is the one where content confidentiality, DRM, EU authentication, and EU authorization are end to end 🔐. Those are the responsibilities of the multicast application source provider and the receiver application. This is the model assumed here, and it's also the model used in Internet "Over the Top" (OTT) video delivery 🍿. Below, we talk through the threats this model picks up from the use of IP multicast in AD-1 or AD-2 and across the peering point.
End-to-end encryption enables end-to-end EU authentication and authorization 🗝️. The EU may be able to join (via IGMP/MLD) and receive the content, but it can only decrypt it once it gets the decryption key from the content source in AD-1. The key is the authorization, bestie 👑. Keeping that key to itself, and blocking playout of the decrypted content to interfaces that aren't copy-protected, are typical DRM features in that receiver application or EU device operating system 🛡️.
End-to-end encryption is constantly under attack 😭. Keys may be hit with brute-force attacks so the content can be decrypted later, or keys get pulled out of the EU application or device and shared with other unauthenticated receivers. One really important class of content is the kind where the value is in live consumption, like sports or other live events (for example, concert streaming) 🏟️. Pulling keying material out of compromised authenticated EUs and sharing it with unauthenticated EUs isn't enough on its own. Those unauthenticated EUs also need a streaming copy of the content itself. With unicast streaming they can't get that copy from the content source, because they can't authenticate. And because of asymmetric bandwidths, it's often impossible to get the content from compromised EUs to a large number of unauthenticated EUs. EUs behind classic "16 Mbps down, 1 Mbps up" ADSL links are the best example 🥲. Broadband speeds keep going up, so unicast peer-to-peer copying of content gets easier. But it will likely always be easy for the ADs to detect because of its traffic patterns and volume 🚨.
When IP multicast is used without additional security, AD-2 has no idea which EU is authenticated for which content 🙈. So any unauthenticated EU in AD-2 could grab a copy of the encrypted content without raising suspicion at AD-2 or AD-1. From there, it could either (1) live-decode it, with help from a compromised authenticated EU and key-sharing, or (2) decrypt it later, with help from federated brute-force key-cracking 💀.
To mitigate this, the last replication point that creates (S,G) copies for EUs would need to allow those copies only after the EUs have been authenticated 🔒. That would set up the same authenticated "EU only" copy that unicast uses.
Schemes for per-EU IP multicast authentication and authorization (and, as a result, stopping non-delivery or copying of per-content IP multicast traffic) have been built in the past and are deployed by service providers for intra-domain IPTV services 📡. But no standards exist for this 😤. For example, there's no standardized RADIUS attribute for authenticating the IGMP/MLD filter set, even though implementations do exist. The authors of this document are also not aware of any schemes where the same credentials used to get the encryption key from the content source could also be used to authenticate and authorize network-layer IP multicast replication for that content. Building such schemes is technically not difficult, and they'd avoid creating and maintaining a separate network traffic-forwarding authentication and authorization scheme that's decoupled from the application's end-to-end authentication and authorization system 🧩.
If you want to deliver this kind of high-value content over the peering described here, the short-term recommendations are these 🎯. Sources should clearly isolate the source and group addresses used for different content bundles, and communicate those (S,G) patterns from AD-1 to AD-2. Then AD-2 can use its existing per-EU authentication and authorization mechanisms in network devices to set up filters for (S,G) sets to each EU 💅.
6.3. Peering Encryption 🌸
Encryption at peering points for multicast delivery may be used, as agreed between AD-1 and AD-2 🤝.
With a private peering link, IP multicast doesn't have attack vectors on that link that are different from those of IP unicast 🙌. But the content owner may have set strict rules against unauthenticated copying, even of end-to-end encrypted content. In that case, AD-1 and AD-2 can agree on extra transport encryption across that peering link 🔐. On a broadcast peering connection (for example, an IXP), transport encryption is again the easiest way to stop other ADs on the same peering point from making unauthenticated copies 🚫.
If peering happens across a tunnel that spans intermittent transit ADs (not discussed in detail in this document), then encrypting that tunnel traffic is recommended 🦋. It doesn't just prevent possible "leakage" of content. It also protects information about what content is being consumed in AD-2, which is a kind of aggregated privacy protection 🫶.
See Section 6.4 for reasons the peering point may also need to be encrypted for operational reasons 🧠.
6.4. Operational Aspects 🛠️
Section 4.3.3 covers the exchange of log information, and Section 7 covers the exchange of program information 📋. All of these operational pieces of data should, by default, be exchanged over authenticated and encrypted peer-to-peer communication protocols between AD-1 and AD-2 🔐. That way, only the intended recipients in the peers' ADs can access them. Even exposing the least sensitive information to third parties opens up attack vectors 😬. For example, putting valid (S,G) information into DNS, so that invalid (S,G) information is easier to filter out, would also let attackers identify valid (S,G) information more easily and switch their attack vector. Passing it through secured channels from AD-1 to AD-2 is the way to go 🙅♀️.
From the ADs' point of view, security matters most for log information 🔍. It gives operational insight into the originating AD, but it also contains sensitive user data 🥺.
Sensitive user data exported from AD-2 to AD-1 as part of logs could be as much as the equivalent of 5-tuple unicast traffic flow accounting, but no more. For example, there's no application-level information in there 🙅♀️. As mentioned in Section 7, with unicast, AD-1 could capture these traffic statistics itself, since it's all about traffic flows originated by AD-1 going to EU receivers in AD-2. When IP multicast is used, though, passing those statistics from AD-2 to AD-1 may be necessary operationally, because the replication happens in AD-2 🔁.
Still, passing traffic statistics inside AD-1, from a capturing router to a backend system, is likely less exposed to third-party attacks than passing them "inter-domain" from AD-2 to AD-1 📦. So more care needs to go into securing the inter-domain version 🔒.
If any protocols used for the operational exchange of information can't be easily secured at the transport layer or higher (because of legacy products or protocols in the network), then AD-1 and AD-2 can also consider sending all operational data exchanges across the same peering point as the traffic. They can then protect it with network-layer encryption at the peering point, as discussed earlier 🛡️.
End-to-end authentication and authorization of EUs may involve some kind of token authentication, and it's done at the application layer, independently of the two ADs 🎟️. If token authentication fails for EUs supported by AD-2, then some way of checking that the token authentication process is running properly should be considered. For example, you could check that the backend servers querying the multicast application source provider's token authentication server are talking to it properly 👀. Implementation details are beyond the scope of this document 🙏.
In the event of a security breach, the two ADs are expected to have a mitigation plan for shutting down the peering point and sending multicast traffic over alternative peering points 🚨. They're also expected to share appropriate information for the purpose of securing the identified breach 🫡.
7. Privacy Considerations 🔒✨
Okay bestie, let's talk privacy 💜 The flow of info about content and EUs in this doc is built to keep things private, and here's the tea 🫖
AD-1 is operating on behalf of (or owns) the content source, so it's part of the content-consumption relationship with the EU 💖 That means the privacy stuff between the EU and AD-1 is basically the same (with one exception, see below) as it would be if no IP multicast was used at all. Especially because end-to-end encryption can and should be used for any privacy-conscious content 🔐
Information related to the inter-domain multicast transport service gets handed to AD-1 by the AD-2 operators 📦 AD-2 doesn't need to gain any extra insight into the user's behavior through this process beyond what it would already have without service collaboration with AD-1 🙈 The only exception is if AD-1 and AD-2 agree on it AND get approval from the EU 🙋♀️
For example, if it's beneficial for the EU to get support directly from AD-2, then AD-2 would generally need to be aware of the mapping between content and network (S,G) state. That way AD-2 knows which (S,G) to troubleshoot when the EU complains about problems with specific content 🔍 How much of this AD-1 shares to meet EU privacy expectations is typically easy for AD-1 to figure out 💅 Two simple examples:
- For a sports content bundle, every EU will happily click on the "I approve that the content program information is shared with your service provider" button 🏈 That's because service-conscious AD-2 would likely also try to make sure high-value content, like the (S,G) for the Super Bowl, is the first to get care when there are network issues 🏆
- If the content in question was content the EU expected more privacy for, the EU should prefer a content bundle that included this content among a large variety of other content, have all content end-to-end encrypted, and not share programming information with AD-2, to maximize privacy 🧚 Nevertheless, the privacy of the EU against AD-2 observing traffic would still be lower than in the equivalent setup using unicast 😭 That's because in unicast, AD-2 could not correlate which EUs are watching the same content and use that to deduce the content. Note that even the setup in Section 3.4, where AD-2 is not involved in IP multicast at all, doesn't provide privacy against this level of analysis by AD-2. There's no transport-layer encryption in AMT, so AD-2 can correlate by on-path traffic analysis who is consuming the same content from an AMT relay, using both the (S,G) join messages in AMT and the identical content segments (that were replicated at the AMT relay) 👀
So, to sum it up: only content consumed by multiple EUs is carried via IP multicast here, and all of that content can be end-to-end encrypted 🎀 That means the only privacy consideration specific to IP multicast is for AD-2 to know or reconstruct what content an EU is consuming. For content where that's undesirable, some of the protections above are possible, but ideally the model described in Section 3.4 could be used together with future work, e.g., adding Datagram Transport Layer Security (DTLS) encryption [RFC6347] between the AMT relay and the EU 🦋
Also, IP multicast by nature would give the EU privacy against the content source operator, because unlike unicast, the content source doesn't natively know which EU is consuming which content. In all cases where AD-2 provides replication, only AD-2 knows this directly 🌸 This document doesn't try to describe a model that keeps that level of privacy against the content source. Instead, it describes a model that only protects against exposure to intermediate parties, in this case AD-2. 💜
8. IANA Considerations 📝
This document does not require any IANA actions 🌈
9. References 📚
9.1. Normative References
[RFC2784] Farinacci, D., Li, T., Hanks, S., Meyer, D., and P.
Traina, "Generic Routing Encapsulation (GRE)", RFC 2784,
DOI 10.17487/RFC2784, March 2000,
<https://www.rfc-editor.org/info/rfc2784>.
[RFC3376] Cain, B., Deering, S., Kouvelas, I., Fenner, B., and A.
Thyagarajan, "Internet Group Management Protocol,
Version 3", RFC 3376, DOI 10.17487/RFC3376, October 2002,
<https://www.rfc-editor.org/info/rfc3376>.
[RFC3810] Vida, R., Ed., and L. Costa, Ed., "Multicast Listener
Discovery Version 2 (MLDv2) for IPv6", RFC 3810,
DOI 10.17487/RFC3810, June 2004,
<https://www.rfc-editor.org/info/rfc3810>.
[RFC4760] Bates, T., Chandra, R., Katz, D., and Y. Rekhter,
"Multiprotocol Extensions for BGP-4", RFC 4760,
DOI 10.17487/RFC4760, January 2007,
<https://www.rfc-editor.org/info/rfc4760>.
[RFC4604] Holbrook, H., Cain, B., and B. Haberman, "Using Internet
Group Management Protocol Version 3 (IGMPv3) and Multicast
Listener Discovery Protocol Version 2 (MLDv2) for
Source-Specific Multicast", RFC 4604,
DOI 10.17487/RFC4604, August 2006,
<https://www.rfc-editor.org/info/rfc4604>.
[RFC4609] Savola, P., Lehtonen, R., and D. Meyer, "Protocol
Independent Multicast - Sparse Mode (PIM-SM) Multicast
Routing Security Issues and Enhancements", RFC 4609,
DOI 10.17487/RFC4609, October 2006,
<https://www.rfc-editor.org/info/rfc4609>.
[RFC7450] Bumgardner, G., "Automatic Multicast Tunneling", RFC 7450,
DOI 10.17487/RFC7450, February 2015,
<https://www.rfc-editor.org/info/rfc7450>.
[RFC7761] Fenner, B., Handley, M., Holbrook, H., Kouvelas, I.,
Parekh, R., Zhang, Z., and L. Zheng, "Protocol Independent
Multicast - Sparse Mode (PIM-SM): Protocol Specification
(Revised)", STD 83, RFC 7761, DOI 10.17487/RFC7761,
March 2016, <https://www.rfc-editor.org/info/rfc7761>.
[BCP38] Ferguson, P. and D. Senie, "Network Ingress Filtering:
Defeating Denial of Service Attacks which employ IP Source
Address Spoofing", BCP 38, RFC 2827, May 2000,
<https://www.rfc-editor.org/info/rfc2827>.
[BCP41] Floyd, S., "Congestion Control Principles", BCP 41,
RFC 2914, September 2000,
<https://www.rfc-editor.org/info/rfc2914>.
[BCP145] Eggert, L., Fairhurst, G., and G. Shepherd, "UDP Usage
Guidelines", BCP 145, RFC 8085, March 2017,
<https://www.rfc-editor.org/info/rfc8085>.9.2. Informative References
[RFC4786] Abley, J. and K. Lindqvist, "Operation of Anycast
Services", BCP 126, RFC 4786, DOI 10.17487/RFC4786,
December 2006, <https://www.rfc-editor.org/info/rfc4786>.
[RFC6347] Rescorla, E. and N. Modadugu, "Datagram Transport Layer
Security Version 1.2", RFC 6347, DOI 10.17487/RFC6347,
January 2012, <https://www.rfc-editor.org/info/rfc6347>.
[INF_ATIS_10]
"CDN Interconnection Use Cases and Requirements in a
Multi-Party Federation Environment", ATIS Standard
A-0200010, December 2012.
[MDH-05] Thaler, D. and B. Aboba, "Multicast Debugging Handbook",
Work in Progress, draft-ietf-mboned-mdh-05, November 2000.
[Traceroute]
"traceroute.org", <http://traceroute.org/#source%20code>.
[Mtrace-v2]
Asaeda, H., Meyer, K., and W. Lee, Ed., "Mtrace Version 2:
Traceroute Facility for IP Multicast", Work in Progress,
draft-ietf-mboned-mtrace-v2-22, December 2017.Acknowledgments 🫶
The authors would like to thank the following individuals for their suggestions, comments, and corrections 💕
- Mikael Abrahamsson
- Hitoshi Asaeda
- Dale Carder
- Tim Chown
- Leonard Giuliano
- Jake Holland
- Joel Jaeggli
- Henrik Levkowetz
- Albert Manfredi
- Stig Venaas
Authors' Addresses 💌
Percy S. Tarapore (editor)
AT&T
Phone: 1-732-420-4172
Email: tarapore@att.com
Robert Sayko
AT&T
Phone: 1-732-420-3292
Email: rs1983@att.com
Greg Shepherd
Cisco
Email: shep@cisco.com
Toerless Eckert (editor)
Huawei USA - Futurewei Technologies Inc.
Email: tte+ietf@cs.fau.de, toerless.eckert@huawei.com
Ram Krishnan
SupportVectors
Email: ramkri123@gmail.com📦 where this page comes from
- ietf: rfc8313 2018-01
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms