RFC 8421
Guidelines for Multihomed and IPv4/IPv6 Dual-Stack Interactive Connectivity Establishment (ICE)
RFC 8421: Guidelines for Multihomed and IPv4/IPv6 Dual-Stack Interactive Connectivity Establishment (ICE) ✨
okay bestie, this is RFC 8421 🦋, a Best Current Practice (that's BCP 217, ISSN 2070-1721) published in July 2018 by P. Martinsen (Cisco), T. Reddy (McAfee, Inc.), and P. Patil (Cisco). The header doesn't list anything it obsoletes or updates, so it's standing on its own 💅. It's all about how to make ICE finish faster when you're multihomed or running IPv4/IPv6 dual-stack and some paths are broken 🔥.
Abstract
okay so the abstract is giving "here's the goal" 🎀. This doc gives guidelines for making Interactive Connectivity Establishment (ICE) conclude faster in multihomed and IPv4/IPv6 dual-stack scenarios where broken paths exist. The guidelines are backward compatible with the original ICE spec, which is RFC 5245 🌸.
Status of This Memo
this memo is a Best Current Practice for the Internet 🌈. It's a product of the Internet Engineering Task Force (IETF) and represents the consensus of the IETF community. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). If you want more info on BCPs, check Section 2 of RFC 7841 🧚.
for the current status, errata, and how to send feedback, go to https://www.rfc-editor.org/info/rfc8421 💜.
Copyright Notice
copyright lore: Copyright (c) 2018 IETF Trust and the persons identified as the document authors. All rights reserved 🔒.
this document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents, found at https://trustee.ietf.org/license-info, as in effect on the date of publication. please actually read these because they spell out your rights and restrictions for this doc 🙈. any Code Components pulled out of this document have to include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come with no warranty, as the Simplified BSD License describes.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Notational Conventions . . . . . . . . . . . . . . . . . . . 3
3. ICE Multihomed Recommendations . . . . . . . . . . . . . . . 3
4. ICE Dual-Stack Recommendations . . . . . . . . . . . . . . . 4
5. Compatibility . . . . . . . . . . . . . . . . . . . . . . . . 5
6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 7
7. Security Considerations . . . . . . . . . . . . . . . . . . . 7
8. References . . . . . . . . . . . . . . . . . . . . . . . . . 8
8.1. Normative References . . . . . . . . . . . . . . . . . . 8
8.2. Informative References . . . . . . . . . . . . . . . . . 8
Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 8
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 91. Introduction 🌸
so picture this: in multihomed and IPv4/IPv6 dual-stack setups, ICE [RFC8445] would really benefit from spreading its connectivity checks fairly across the available interfaces or IP address types 💅. When the checks are spread fairly, you avoid huge delays when one network path is broken or slow. Honestly, it would be nicer to put the interfaces or address types the application already knows about last in the checklist. BUT ICE's whole main goal is to make no assumptions about network topology, so a fair spread is the better fit 🫶. if an application runs in a well-known environment, it can safely override the recommendation in this doc ✨.
applications should take special care to deprioritize network interfaces they know give unreliable connectivity when they're in a multihomed environment 😭. certain tunnel services, for example, might be unreliable. doing this keeps the connectivity checks fairly spread across the device's network interfaces. the simple guidelines here explain how to deprioritize interfaces the application knows to be unreliable 🎀.
there's also a need for better handling of connectivity checks across IP address families in dual-stack IPv4/IPv6 ICE. following the recommendations from RFC 6724 [RFC6724] means IPv6 gets prioritized over IPv4 for the same candidate type 👑. because of that, checks for candidates of the same type (host, reflexive, or relay) get sent so that one address family is completely used up before checks for the other family even start. that causes noticeable delays during setup if the prioritized family's path is broken 💀.
to avoid those noticeable delays when either the IPv6 or IPv4 path is broken or painfully slow, this spec encourages mixing the address families together while checks run 🦋. this leads to more sustained dual-stack IPv4/IPv6 deployment, because users stop having a reason to turn IPv6 off 🌈. the cost is a small penalty for the address type that would otherwise have been prioritized. this document also recommends keeping track of previous known connectivity problems and giving those addresses a lower priority 🧚. the specific mechanisms and rules for tracking connectivity issues are out of scope for this document 🙈.
this document describes which parameters an agent can safely change to fairly order the checklist candidate pairs in multihomed and dual-stack environments. that changes the sending order of the connectivity checks 💖. the actual values of those parameters are an implementation detail. depending on the nomination method in use, this might change which candidate pair ends up as the active one. ultimately, it should be up to the agent to decide which candidate pair is best for transporting media ✨.
the guidelines in this spec are backward compatible with the original ICE implementation. this spec only changes the values used to build the resulting checklists, so the core mechanisms from the original ICE spec [RFC5245] and its replacement [RFC8445] are still in effect 🍓.
2. Notational Conventions 📝
this document uses terminology defined in [RFC8445] 🫶.
3. ICE Multihomed Recommendations 🌐
a multihomed ICE agent can potentially send and receive connectivity checks on all available interfaces and IP addresses 🦋. one interface can have several IP addresses attached to it. to avoid unnecessary delay during connectivity checks, it would be great to prioritize interfaces and IP addresses the agent knows give stable connectivity 💅.
the application can figure out how reliable an interface is in a few ways. it can use simple metrics like previous connection success and failure rates. or it can use a more static model based on interface types (wired, wireless, cellular, virtual, and tunneled), together with other operational metrics. the catch is that this requires the application to have the right permissions to get those operational metrics 🔒.
candidates from an interface the application knows to be unreliable should get a low candidate priority 😭. what counts as unreliable is implementation specific. ICE isn't only for Voice over IP (VoIP) apps, either 💖. what an application sees as unreliability might depend on a mix of how long-lived the connection is, how often setup is needed, and other requirements that are, for now, unknown 🌸. this is purely an optimization to speed up the ICE connectivity check phase ✨.
if the application can't get any interface info about type, or it can't store any relevant metrics, it should treat all interfaces as reliable 🫶. that way every interface gets a fair chance to do its connectivity checks 🎀.
4. ICE Dual-Stack Recommendations 👑
candidates should be prioritized so that a run of candidates from one address family gets mixed with candidates from the other IP family 🦋. for example, promote IPv4 candidates when there are lots of IPv6 candidates, so that an IPv4 address candidate always shows up after a small run of IPv6 candidates. in other words, reorder candidates so both IPv6 and IPv4 candidates get a fair chance during the connectivity check phase 💅. this makes ICE checks more responsive to broken-path failures in one address family 🧚.
an ICE agent can pick whatever algorithm or technique it likes to make sure the resulting checklists have a fair, mixed blend of IPv4 and IPv6 address families 🌈. BUT changing the checklist directly can lead to uncoordinated local and remote checklists, and then ICE might take longer to finish or, in the worst case, fail 😭. the best approach is to set the right value for local preference in the formula for the candidate priority value, as described in the "Recommended Formula" section (Section 5.1.2.1) of [RFC8445] 💖.
implementations should prioritize IPv6 candidates by putting some of them first in the intermingled checklist 👑. this raises the chance that IPv6 connectivity checks finish first and are ready for nomination or use ✨. it also lets implementations follow the intent of "Happy Eyeballs: Success with Dual-Stack Hosts" [RFC8305]. it's worth noting that the timing recommendations in [RFC8305] get overruled by how ICE paces out its connectivity checks 🙈.
here's a simple formula for how many IPv6 addresses to put before any IPv4 addresses 🍓:
Hi = (N_4 + N_6) / N_4
Where Hi = Head start before intermingling starts
N_4 = Number of IPv4 addresses
N_6 = Number of IPv6 addressesso say a host has two IPv4 addresses and six IPv6 addresses 🎀. it will insert an IPv4 address after four IPv6 addresses 💜, by choosing the right local preference values when it calculates the pair priorities 🌸.
5. Compatibility ✨
okay so bestie, the formula in Section 5.1.2 of [RFC8445] is what you use to work out the candidate priority 💖 here it is:
priority = (2^24)*(type preference) +
(2^8)*(local preference) +
(2^0)*(256 - component ID)"Guidelines for Choosing Type and Local Preferences" (Section 5.1.2.2 of [RFC8445]) is where you find tips on picking the type preference and local preference values 🎀. Here's the fun part: instead of giving IPv4 and IPv6 addresses one static local preference each, you can pick the value dynamically so the IPv4 and IPv6 candidate priorities get intermingled inside the same candidate type 🧚. You can also give lower priorities to IP addresses that come from unreliable interfaces by using the local preference value 🥺.
Quick reminder that Section 5.1.2.1 of [RFC8445] says "if there are multiple candidates for a particular component for a particular data stream that have the same type, the local preference MUST be unique for each one". Don't skip that one, it's a must 💅.
The local type preference can also change dynamically, so IPv4 and IPv6 address candidates end up intermingled no matter what candidate type they are 🦋. This comes in clutch if there are tons of IPv6 host candidates blocking connectivity checks for IPv4 server reflexive candidates 😭.
Candidates with IP addresses from an unreliable interface should be ordered at the end of the checklist, meaning they are not intermingled like the dual-stack candidates 🍓.
The list below is a sorted local candidate list where the priority is calculated so the IPv4 and IPv6 candidates are intermingled (no multihomed candidates) 🌈. To give the IPv4 server reflexive candidates an earlier connectivity check, some of the IPv6 host candidates get demoted 👑. This is just an example of how you can calculate candidate priorities to get better fairness between IPv4 and IPv6 candidates without breaking any of the ICE connectivity checks ✨.
Candidate Address Component
Type Type ID Priority
-------------------------------------------
(1) HOST IPv6 (1) 2129289471
(2) HOST IPv6 (2) 2129289470
(3) HOST IPv4 (1) 2129033471
(4) HOST IPv4 (2) 2129033470
(5) HOST IPv6 (1) 2128777471
(6) HOST IPv6 (2) 2128777470
(7) HOST IPv4 (1) 2128521471
(8) HOST IPv4 (2) 2128521470
(9) HOST IPv6 (1) 2127753471
(10) HOST IPv6 (2) 2127753470
(11) SRFLX IPv6 (1) 1693081855
(12) SRFLX IPv6 (2) 1693081854
(13) SRFLX IPv4 (1) 1692825855
(14) SRFLX IPv4 (2) 1692825854
(15) HOST IPv6 (1) 1692057855
(16) HOST IPv6 (2) 1692057854
(17) RELAY IPv6 (1) 15360255
(18) RELAY IPv6 (2) 15360254
(19) RELAY IPv4 (1) 15104255
(20) RELAY IPv4 (2) 15104254
SRFLX = server reflexiveNotice the list doesn't change the component ID part of the formula 🎀. That keeps the different components (RTP and the Real-time Transport Control Protocol (RTCP)) close together in the list 🫶. What matters is the ordering of the candidates with component ID 1 🔥. Once the checklist is formed for a media stream, the candidate pair with component ID 1 gets tested first. If the ICE connectivity check succeeds, then the other candidate pairs with the same foundation get unfrozen (see "Computing Candidate Pair States" in Section 6.1.2.6 of [RFC8445]) 🌸.
The local and remote agent can use different algorithms to choose the local preference and type preference values without messing up the synchronization between the local and remote checklists 💜.
The checklist is made up of candidate pairs. A candidate pair is two candidates paired up and given a candidate pair priority, as described in Section 6.1.2.3 of [RFC8445] ✨. The pair priority formula is:
pair priority = 2^32*MIN(G,D) + 2*MAX(G,D) + (G>D?1:0)In that formula, G is the candidate priority provided by the controlling agent, and D is the candidate priority provided by the controlled agent 🧚. This is what keeps the local and remote checklists coordinated 🫶.
Even if the two agents use different algorithms to pick the candidate priority value and end up with an intermingled set of IPv4 and IPv6 candidates, the resulting checklist (a list sorted by the pair priority value) will be identical on both agents 💖.
The agent that has promoted IPv4 cautiously, meaning it uses lower IPv4 candidate priority values compared to the other agent, will influence the checklist the most because of the (2^32*MIN(G,D)) part of the formula 🥹.
These recommendations are backward compatible with the original ICE implementation 🦋. The resulting local and remote checklist will still be synchronized 🌈.
Depending on the nomination method in use, the procedures described in this document might change which candidate pair ends up as the active one 👀.
A test implementation of an example algorithm is available at [ICE_dualstack_imp] 💅.
6. IANA Considerations 🦋
This document has no IANA actions. Nothing to register, nothing to update, just vibes ✨.
7. Security Considerations 🔐
Okay, bestie, this one is serious 😭. The security considerations described in [RFC8445] are valid. This document changes the recommended values and describes how an agent could choose those values in a safe way 🛡️. In Section 3, the agent can prioritize the network interface based on previous network knowledge. That can potentially be unwanted information leakage towards the remote agent 🙈.
⚠️ Heads up: prioritizing a network interface based on what the agent already knows about the network could leak information to the remote agent. Be careful with it, fr fr.
8. References 📚
8.1. Normative References
[RFC5245] Rosenberg, J., "Interactive Connectivity Establishment
(ICE): A Protocol for Network Address Translator (NAT)
Traversal for Offer/Answer Protocols", RFC 5245,
DOI 10.17487/RFC5245, April 2010,
<https://www.rfc-editor.org/info/rfc5245>.
[RFC6724] Thaler, D., Ed., Draves, R., Matsumoto, A., and T. Chown,
"Default Address Selection for Internet Protocol Version 6
(IPv6)", RFC 6724, DOI 10.17487/RFC6724, September 2012,
<https://www.rfc-editor.org/info/rfc6724>.
[RFC8305] Schinazi, D. and T. Pauly, "Happy Eyeballs Version 2:
Better Connectivity Using Concurrency", RFC 8305,
DOI 10.17487/RFC8305, December 2017,
<https://www.rfc-editor.org/info/rfc8305>.
[RFC8445] Keranen, A., Holmberg, C., and J. Rosenberg, "Interactive
Connectivity Establishment (ICE): A Protocol for Network
Address Translator (NAT) Traversal", RFC 8445,
DOI 10.17487/RFC8445, July 2018,
<https://www.rfc-editor.org/info/rfc8445>.8.2. Informative References
[ICE_dualstack_imp]
"ICE Happy Eyeball Test Algorithms", commit 45083fb,
January 2014,
<https://github.com/palerikm/ICE-DualStackFairness>.Acknowledgements 🫶
The authors want to thank Dan Wing, Ari Keranen, Bernard Aboba, Martin Thomson, Jonathan Lennox, Balint Menyhart, Ole Troan, Simon Perreault, Ben Campbell, and Mirja Kuehlewind for their comments and review 💖. Huge thanks, you all are iconic 👑.
Authors' Addresses 💌
Paal-Erik Martinsen
Cisco Systems, Inc.
Philip Pedersens Vei 22
Lysaker, Akershus 1325
Norway
Email: palmarti@cisco.com
Tirumaleswar Reddy
McAfee, Inc.
Embassy Golf Link Business Park
Bangalore, Karnataka 560071
India
Email: TirumaleswarReddy_Konda@McAfee.com
Prashanth Patil
Cisco Systems, Inc.
Bangalore
India
Email: praspati@cisco.comThat's the whole RFC, bestie 🌈✨ you survived the ICE dual-stack glow-up 💅🎀
📦 where this page comes from
- ietf: rfc8421 2018-07
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms