RFC 9359
Echo Request/Reply for Enabled In Situ OAM (IOAM) Capabilities
RFC 9359 🎀 Title Block
Okay bestie, this is RFC 9359, and it's called Echo Request/Reply for Enabled In Situ OAM (IOAM) Capabilities ✨. Three people wrote it: X. Min from ZTE Corp., G. Mirsky from Ericsson, and L. Bo from China Telecom. It's a Standards Track doc (ISSN 2070-1721), dated April 2023. The title block doesn't list anything it obsoletes or updates, so it's a standalone main character 💅
Abstract ✨
So this doc describes a generic format for echo request/reply mechanisms 🦋 These can be used inside an IOAM-Domain, and they let the IOAM encapsulating node figure out which IOAM capabilities are enabled on each IOAM transit and IOAM decapsulating node. The format is meant to work with a bunch of data planes: IPv6, MPLS, Service Function Chain (SFC), and Bit Index Explicit Replication (BIER). It's giving versatile 🌈
Status of This Memo 📜
This is an Internet Standards Track document, obvi 💖
It's a product of the Internet Engineering Task Force (IETF) and represents the consensus of the IETF community. It went through public review and got approved for publication by the Internet Engineering Steering Group (IESG). If you want more on Internet Standards, check Section 2 of RFC 7841 🌸
Info about the current status of this document, any errata, and how to give feedback is at https://www.rfc-editor.org/info/rfc9359.
Copyright Notice 🔒
Copyright (c) 2023 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as they stand on the date this document was published. Please actually read these, because they spell out your rights and restrictions for this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come without warranty as described in the Revised BSD License 🫶
Table of Contents 🗂️
1. Introduction
2. Conventions
2.1. Requirements Language
2.2. Abbreviations
3. IOAM Capabilities Formats
3.1. IOAM Capabilities Query Container
3.2. IOAM Capabilities Response Container
3.2.1. IOAM Pre-allocated Tracing Capabilities Object
3.2.2. IOAM Incremental Tracing Capabilities Object
3.2.3. IOAM Proof of Transit Capabilities Object
3.2.4. IOAM Edge-to-Edge Capabilities Object
3.2.5. IOAM DEX Capabilities Object
3.2.6. IOAM End-of-Domain Object
4. Operational Guide
5. IANA Considerations
5.1. IOAM SoP Capability Registry
5.2. IOAM TSF Capability Registry
6. Security Considerations
7. References
7.1. Normative References
7.2. Informative References
Acknowledgements
Authors' Addresses1. Introduction 🚀
Okay so, In situ Operations, Administration, and Maintenance (IOAM) ([RFC9197] [RFC9326]) defines data fields that record OAM info inside the packet while it travels through a particular network domain, called an "IOAM-Domain" 🧚 IOAM can complement or even replace other OAM mechanisms, like ICMP or other kinds of probe packets.
As [RFC9197] explains, inside the IOAM-Domain, network nodes that the packet goes through can update the IOAM data. The device that adds an IOAM header to the packet is called an "IOAM encapsulating node". The device that removes it is an "IOAM decapsulating node". Nodes in the domain that know about IOAM data and read, write, and/or process it are called "IOAM transit nodes" 👑 An IOAM encapsulating or decapsulating node can also be an IOAM transit node at the same time. These are also called IOAM-Domain "edge devices", which can be hosts or network devices. [RFC9197] defines four IOAM option types, and [RFC9326] adds a new one called the "Direct Export (DEX) Option-Type". It's different from the other four because of how it collects the operational and telemetry info defined in [RFC9197] 💅
As [RFC9197] says, IOAM is focused on "limited domains" as defined in [RFC8799]. In a limited domain, there might be a control entity with control over every IOAM device. If that's the case, the control entity can set up both the explicit transport path and the IOAM header applied to the data packet at every IOAM encapsulating node 🎀
But what if there's no control entity that controls every IOAM device in the IOAM-Domain? Then the IOAM encapsulating node has to discover the enabled IOAM capabilities at the IOAM transit and decapsulating nodes. For example, it needs to know what kinds of IOAM tracing data the transit nodes along the transport path can add or export 🔍 Once it knows that, it can add the correct IOAM header to the data packet. More specifically, it first works out the types and lengths of the IOAM options included in the IOAM data fields based on the discovered capabilities. Then it adds the IOAM header to the data packet based on those identified types and lengths 🌸
The IOAM encapsulating node may use NETCONF/YANG or IGP to discover these capabilities. But both have some limitations, bestie 😬
- When NETCONF/YANG is used here, every IOAM encapsulating node (including a host acting as one) has to implement a NETCONF Client, and every IOAM transit and IOAM decapsulating node (including a host acting as a decapsulating node) has to implement a NETCONF Server. So complexity can be an issue. On top of that, each IOAM encapsulating node has to set up a NETCONF Connection with each IOAM transit and IOAM decapsulating node, so scalability can be an issue too 📉
- When IGP is used here, the IGP and the IOAM-Domains don't always cover the same stuff. For example, if the IOAM encapsulating or decapsulating node is a host, availability can be an issue. Also, it might be way too challenging to reflect the enabled IOAM capabilities at the IOAM transit and IOAM decapsulating nodes if they're controlled by a local policy that depends on the identity of the IOAM encapsulating node 🙈
This document specifies formats and objects that can extend echo request/reply mechanisms used in IPv6 (including the Segment Routing over IPv6 (SRv6) data plane), MPLS (including the Segment Routing over MPLS (SR-MPLS) data plane), Service Function Chain (SFC), and Bit Index Explicit Replication (BIER) environments. These can be used within the IOAM-Domain, letting the IOAM encapsulating node discover the enabled IOAM capabilities of each IOAM transit and IOAM decapsulating node ✨
The following documents talk about the echo request/reply mechanisms used in IPv6 (including SRv6), MPLS (including SR-MPLS), SFC, and BIER environments:
- "Internet Control Message Protocol (ICMPv6) for the Internet Protocol Version 6 (IPv6) Specification" [RFC4443]
- "IPv6 Node Information Queries" [RFC4620]
- "Extended ICMP to Support Multi-Part Messages" [RFC4884]
- "PROBE: A Utility for Probing Interfaces" [RFC8335]
- "Detecting Multiprotocol Label Switched (MPLS) Data-Plane Failures" [RFC8029]
- "Active OAM for Service Function Chaining (SFC)" [OAM-for-SFC]
- "BIER Ping and Trace" [BIER-PING]
It's expected that the spec for each of these extensions will be done as an RFC, jointly designed by the working group that develops or maintains the echo request/reply protocol and the IETF IP Performance Measurement (IPPM) Working Group 🧁
Also, in this document, the echo request/reply mechanism used in IPv6 does not mean ICMPv6 Echo Request/Reply [RFC4443]. It does mean IPv6 Node Information Query/Reply [RFC4620] 🤭
Fate sharing is a common requirement for all kinds of active OAM packets, including echo requests. Here, that means an echo request is required to traverse the path of an IOAM data packet. You can achieve this by, e.g., applying the same explicit path or ECMP processing to both the echo request and the IOAM data packets. Specifically, the same ECMP processing can be applied to both by putting the same value or values in any ECMP affecting fields of the packets 💜
2. Conventions 📝
2.1. Requirements Language 🔑
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here 🫶
2.2. Abbreviations 🔤
BIER: Bit Index Explicit Replication
BGP: Border Gateway Protocol
DEX: Direct Export
ECMP: Equal-Cost Multipath
E2E: Edge to Edge
ICMP: Internet Control Message Protocol
IGP: Interior Gateway Protocol
IOAM: In situ Operations, Administration, and Maintenance
LSP: Label Switched Path
MPLS: Multiprotocol Label Switching
MTU: Maximum Transmission Unit
NETCONF: Network Configuration Protocol
NTP: Network Time Protocol
OAM: Operations, Administration, and Maintenance
PCEP: Path Computation Element Communication Protocol
POSIX: Portable Operating System Interface
POT: Proof of Transit
PTP: Precision Time Protocol
SoP: Size of POT
SR-MPLS: Segment Routing over MPLS
SRv6: Segment Routing over IPv6
SFC: Service Function Chain
TTL: Time to Live (this is also the Hop Limit field in the IPv6
header)
TSF: TimeStamp Format3. IOAM Capabilities Formats 🎀
3.1. IOAM Capabilities Query Container 🌸
okay so for echo requests, the IOAM Capabilities Query uses a container that looks like this 👇
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
. .
. IOAM Capabilities Query Container Header .
. .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
. .
. List of IOAM Namespace-IDs .
. .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Figure 1: IOAM Capabilities Query Container of an Echo Request
When this container is in the echo request sent by an IOAM encapsulating node, that node is basically asking the receiving node to reply with its enabled IOAM capabilities. 💅 If there is no IOAM capability for the receiving node to report, then this container MUST be ignored by the receiving node. That means the receiving node MUST send an echo reply without IOAM capabilities or no echo reply at all, depending on whether the echo request includes containers other than the IOAM Capabilities Query Container. ✨ A list of IOAM Namespace-IDs (one or more Namespace-IDs) MUST be included in this container in the echo request. If the Default-Namespace-ID 0x0000 is present, it MUST be placed at the beginning of the list of IOAM Namespace-IDs. The IOAM encapsulating node only requests the enabled IOAM capabilities that match one of the Namespace-IDs. Including the Default-Namespace-ID 0x0000 only gets replies for capabilities that are configured with the Default-Namespace-ID 0x0000. The Namespace-ID has the same definition as what's specified in Section 4.3 of [RFC9197]. 🎀
The IOAM Capabilities Query Container has a container header that identifies the type and, optionally, the length of the container payload. The container payload (List of IOAM Namespace-IDs) is zero-padded so it lines up with a 4-octet boundary. Since the Default-Namespace-ID 0x0000 is mandated to appear first in the list, any other occurrences of 0x0000 MUST be disregarded. 🙈
The length, structure, and definition of the IOAM Capabilities Query Container Header depend on the specific deployment environment. 🌈
3.2. IOAM Capabilities Response Container 🦋
for echo replies, the IOAM Capabilities Response uses a container that looks like this 👇
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
. .
. IOAM Capabilities Response Container Header .
. .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
. .
. List of IOAM Capabilities Objects .
. .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Figure 2: IOAM Capabilities Response Container for an Echo Reply
When this container is in the echo reply sent by an IOAM transit node or IOAM decapsulating node, it means the IOAM function is enabled at that node, and the container holds the enabled IOAM capabilities of the sender. ✨ A list of IOAM capabilities objects (one or more objects) that contains the enabled IOAM capabilities MUST be included in this container of the echo reply, unless the sender runs into an error (e.g., no matched Namespace-ID). 💖
The IOAM Capabilities Response Container has a container header that identifies the type and, optionally, the length of the container payload. The container header MUST be defined such that it falls on a 4-octet boundary. 🧚
The length, structure, and definition of the IOAM Capabilities Response Container Header depend on the specific deployment environment. 🌸
Based on the IOAM data fields defined in [RFC9197] and [RFC9326], six types of objects are defined in this document. The same type of object MAY be present in the IOAM Capabilities Response Container more than once, but only if it's listed with a different Namespace-ID. 👑
Similar to the container, each object has an object header that identifies the type and length of the object payload. The object payload MUST be defined such that it falls on a 4-octet boundary. 💅
The length, structure, and definition of the object header depend on the specific deployment environment. 🫶
3.2.1. IOAM Pre-allocated Tracing Capabilities Object 🍓
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
. .
. IOAM Pre-allocated Tracing Capabilities Object Header .
. .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| IOAM-Trace-Type | Reserved |W|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Namespace-ID | Ingress_MTU |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Ingress_if_id (short or wide format) ...... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Figure 3: IOAM Pre-allocated Tracing Capabilities Object
When the IOAM Pre-allocated Tracing Capabilities Object is in the IOAM Capabilities Response Container, the sending node is an IOAM transit node, and the IOAM pre-allocated tracing function is enabled at that IOAM transit node. 🌈
The IOAM-Trace-Type field has the same definition as what's specified in Section 4.4 of [RFC9197]. ✨
The Reserved field MUST be zeroed on transmission and ignored on receipt. 🙈
The W flag tells you whether Ingress_if_id is in short or wide format. The W-bit is set if the Ingress_if_id is in wide format, and clear if it's in short format. 🦋
The Namespace-ID field has the same definition as what's specified in Section 4.3 of [RFC9197]. It MUST be one of the Namespace-IDs listed in the IOAM Capabilities Query Object of the echo request. 🎀
The Ingress_MTU field has 16 bits and specifies the MTU (in octets) of the ingress interface from which the sending node received the echo request. 🌸
The Ingress_if_id field has 16 bits (in short format) or 32 bits (in wide format), and it specifies the identifier of the ingress interface from which the sending node received the echo request. If the W-bit is cleared, the Ingress_if_id field has 16 bits. Then the 16 bits following the Ingress_if_id field are reserved for future use, MUST be set to zero, and MUST be ignored when non-zero. 🔥
3.2.2. IOAM Incremental Tracing Capabilities Object 💜
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
. .
. IOAM Incremental Tracing Capabilities Object Header .
. .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| IOAM-Trace-Type | Reserved |W|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Namespace-ID | Ingress_MTU |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Ingress_if_id (short or wide format) ...... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Figure 4: IOAM Incremental Tracing Capabilities Object
When the IOAM Incremental Tracing Capabilities Object is in the IOAM Capabilities Response Container, the sending node is an IOAM transit node, and the IOAM incremental tracing function is enabled at that IOAM transit node. 🧚
The IOAM-Trace-Type field has the same definition as what's specified in Section 4.4 of [RFC9197]. 🌸
The Reserved field MUST be zeroed on transmission and ignored on receipt. 💅
The W flag tells you whether Ingress_if_id is in short or wide format. The W-bit is set if the Ingress_if_id is in wide format, and clear if it's in short format. 🫶
The Namespace-ID field has the same definition as what's specified in Section 4.3 of [RFC9197]. It MUST be one of the Namespace-IDs listed in the IOAM Capabilities Query Object of the echo request. 👑
The Ingress_MTU field has 16 bits and specifies the MTU (in octets) of the ingress interface from which the sending node received the echo request. 🦋
The Ingress_if_id field has 16 bits (in short format) or 32 bits (in wide format), and it specifies the identifier of the ingress interface from which the sending node received the echo request. If the W-bit is cleared, the Ingress_if_id field has 16 bits. Then the 16 bits following the Ingress_if_id field are reserved for future use, MUST be set to zero, and MUST be ignored when non-zero. 🌈
3.2.3. IOAM Proof of Transit Capabilities Object ✨
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
. .
. IOAM Proof of Transit Capabilities Object Header .
. .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Namespace-ID | IOAM-POT-Type |SoP| Reserved |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Figure 5: IOAM Proof of Transit Capabilities Object
When the IOAM Proof of Transit Capabilities Object is in the IOAM Capabilities Response Container, the sending node is an IOAM transit node and the IOAM Proof of Transit function is enabled at that IOAM transit node. 🔥
The Namespace-ID field has the same definition as what's specified in Section 4.3 of [RFC9197]. It MUST be one of the Namespace-IDs listed in the IOAM Capabilities Query Object of the echo request. 🎀
The IOAM-POT-Type field has the same definition as what's specified in Section 4.5 of [RFC9197]. 🌸
The SoP (Size of POT) field has two bits that indicate the size of "PktID" and "Cumulative" data, which are specified in Section 4.5 of [RFC9197]. This document defines SoP as follows:
0b00: 64-bit "PktID" and 64-bit "Cumulative" data0b01~0b11: reserved for future standardization
The Reserved field MUST be zeroed on transmission and ignored on receipt. 🙈
3.2.4. IOAM Edge-to-Edge Capabilities Object 🦋
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
. .
. IOAM Edge-to-Edge Capabilities Object Header .
. .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Namespace-ID | IOAM-E2E-Type |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|TSF| Reserved | Reserved |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Figure 6: IOAM Edge-to-Edge Capabilities Object
Okay so when this object shows up in the IOAM Capabilities Response Container, it's telling you that the sending node is an IOAM decapsulating node and the IOAM edge-to-edge function is turned on there. It's giving "I'm the exit and I'm ready" 💅✨
The Namespace-ID field has the same definition as what's specified in Section 4.3 of [RFC9197]. It MUST be one of the Namespace-IDs listed in the IOAM Capabilities Query Object of the echo request. No cap, this one is strict 🙈
The IOAM-E2E-Type field has the same definition as what's specified in Section 4.6 of [RFC9197]. 🎀
The TSF field tells you which timestamp format the sending node is using. This doc lines up with the three timestamp formats from Section 5 of [RFC9197], and TSF works like this:
0b00: PTP truncated timestamp format0b01: NTP 64-bit timestamp format0b10: POSIX-based timestamp format0b11: Reserved for future standardization
The Reserved field MUST be zeroed on transmission and ignored on receipt. Zeros out, nothing else matters 🫶
3.2.5. IOAM DEX Capabilities Object 🌸
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
. .
. IOAM DEX Capabilities Object Header .
. .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| IOAM-Trace-Type | Reserved |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Namespace-ID | Reserved |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Figure 7: IOAM DEX Capabilities Object
When this object is in the IOAM Capabilities Response Container, the sending node is an IOAM transit node, and the IOAM direct exporting function is enabled there. So this is the transit node going "I can export directly, bestie" 🧚
The IOAM-Trace-Type field has the same definition as what's specified in Section 3.2 of [RFC9326]. 💜
The Namespace-ID field has the same definition as what's specified in Section 4.3 of [RFC9197]. It MUST be one of the Namespace-IDs listed in the IOAM Capabilities Query Object of the echo request. Same rule as before, we don't break it 💖
The Reserved field MUST be zeroed on transmission and ignored on receipt. ✨
3.2.6. IOAM End-of-Domain Object 🍓
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
. .
. IOAM End-of-Domain Object Header .
. .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Namespace-ID | Reserved |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Figure 8: IOAM End-of-Domain Object
When this object is in the IOAM Capabilities Response Container, the sending node is an IOAM decapsulating node. Here's the tea: unless the IOAM Edge-to-Edge Capabilities Object is also there (which already tells you the sender is a decapsulating node), the IOAM End-of-Domain Object MUST be present in the IOAM Capabilities Response Container sent by an IOAM decapsulating node. 🙈👑
When the IOAM edge-to-edge function is enabled at the IOAM decapsulating node, including only the IOAM Edge-to-Edge Capabilities Object, not the IOAM End-of-Domain Object, is RECOMMENDED. So if edge-to-edge is on, the E2E object on its own is the move 💅
The Namespace-ID field has the same definition as what's specified in Section 4.3 of [RFC9197]. It MUST be one of the Namespace-IDs listed in the IOAM Capabilities Query Container. Yep, the Container, not the Object, just like the spec says 🎀
Reserved field MUST be zeroed on transmission and ignored on receipt. Zeros only, periodt 🫶
4. Operational Guide 🗺️
Once the IOAM encapsulating node is triggered to find out which IOAM capabilities are enabled on each IOAM transit and IOAM decapsulating node, it's going to send echo requests that carry the IOAM Capabilities Query Container. It goes like this:
- First, it uses TTL equal to 1 to reach the closest node, which may or may not be an IOAM transit node. 🌱
- Then it uses TTL equal to 2 to reach the second-nearest node, which also may or may not be an IOAM transit node. 🌿
- Then it keeps bumping the TTL up by 1 every time it sends a new echo request, until the IOAM encapsulating node gets an echo reply from the IOAM decapsulating node. That reply carries the IOAM Capabilities Response Container with either the IOAM Edge-to-Edge Capabilities Object or the IOAM End-of-Domain Object in it. 🦋
So the echo requests from the IOAM encapsulating node hit every node one by one along the transport path of the IOAM data packet. It's like a little tour guide, honestly ✨
Alternatively, if the IOAM encapsulating node already knows exactly which IOAM transit and IOAM decapsulating nodes are out there, then once it's triggered to discover the enabled IOAM capabilities, it can just send an echo request straight to each IOAM transit and IOAM decapsulating node, no TTL expiration needed. Shortcut unlocked 🧚
The IOAM encapsulating node may be triggered by the device administrator, the network management system, the network controller, or data traffic. The specific triggering mechanisms are outside the scope of this document. Not our problem here, so we're leaving it alone 💜
Each IOAM transit and IOAM decapsulating node that receives an echo request containing the IOAM Capabilities Query Container will send an echo reply to the IOAM encapsulating node. The echo reply has an IOAM Capabilities Response Container holding one or more Objects. The IOAM Capabilities Query Container of the echo request would be ignored by the receiving node unaware of IOAM. So a node that doesn't know IOAM just shrugs it off 🤷♀️
Heads up: the mechanism in this document works for every kind of IOAM option type, whether that's the four types from [RFC9197] or the DEX type from [RFC9326]. 🔥
Note that the mechanism defined in this document applies to all kinds of IOAM option types, whether the four types of IOAM options defined in [RFC9197] or the DEX type of IOAM option defined in [RFC9326]. Specifically, when it's applied to the IOAM DEX option, the mechanism lets the IOAM encapsulating node discover which nodes along the transport path support IOAM direct exporting, and which trace data types can be directly exported at those nodes. Main character energy for the DEX option 👑
5. IANA Considerations 📋
IANA has created a registry named "In Situ OAM (IOAM) Capabilities". 🌈
This registry includes the following subregistries:
- IOAM SoP Capability
- IOAM TSF Capability
The subsequent subsections detail the registries herein contained. 💖
Considering the Containers/Objects defined in this document that would be carried in different types of Echo Request/Reply messages, such as ICMPv6 or LSP Ping, it is intended that the registries for Container/Object Type would be requested in subsequent documents. So the Container/Object Type registries will show up in later docs, not this one 🦋
5.1. IOAM SoP Capability Registry 🌸
This registry defines four codepoints for the IOAM SoP Capability field, used to identify the size of "PktID" and "Cumulative" data as explained in Section 4.5 of [RFC9197]. Four slots, all in the same bucket 🍓
A new entry in this registry requires the following fields:
- SoP (Size of POT): a 2-bit binary field as defined in Section 3.2.3.
- Description: a terse description of the meaning of this SoP value.
The registry initially contains the following value:
+======+=============================================+
| SoP | Description |
+======+=============================================+
| 0b00 | 64-bit "PktID" and 64-bit "Cumulative" data |
+------+---------------------------------------------+Table 1: SoP and Description
0b01 - 0b11 are available for assignment via the IETF Review process as per [RFC8126]. So those three are up for grabs, just go through IETF Review 💅
5.2. IOAM TSF Capability Registry 🧚
This registry defines four codepoints for the IOAM TSF Capability field, used to identify the timestamp format as explained in Section 5 of [RFC9197]. Same vibe as the SoP one, just for timestamps ⏰
A new entry in this registry requires the following fields:
- TSF (TimeStamp Format): a 2-bit binary field as defined in Section 3.2.4.
- Description: a terse description of the meaning of this TSF value.
The registry initially contains the following values:
+======+================================+
| TSF | Description |
+======+================================+
| 0b00 | PTP Truncated Timestamp Format |
+------+--------------------------------+
| 0b01 | NTP 64-bit Timestamp Format |
+------+--------------------------------+
| 0b10 | POSIX-based Timestamp Format |
+------+--------------------------------+Table 2: TSF and Description
0b11 is available for assignment via the IETF Review process as per [RFC8126]. Last open slot, so it's a little bit special 🌈
6. Security Considerations ✨
Okay so, the security needs for IOAM capabilities query mechanisms are pretty much the same no matter what environment you're in 🔐
To dodge Denial-of-Service (DoS) attacks, it is RECOMMENDED that implementations apply rate-limiting to incoming echo requests and replies 🛑
To keep unauthorized sources from sending echo request messages to grab IOAM Capabilities information, implementations MUST provide a way to check the source addresses of echo request messages against an access list before they accept the message 🚫
A deployment MUST make sure that border-filtering drops inbound echo requests carrying an IOAM Capabilities Container Header from outside of the domain, and that it drops outbound echo requests or replies with IOAM Capabilities Headers leaving the domain 🧱
A deployment MUST support the configuration option that enables or disables the IOAM Capabilities Discovery feature defined in this document. By default, the IOAM Capabilities Discovery feature MUST be disabled 🙈
The integrity protection on IOAM Capabilities information carried in echo reply messages can come from the underlying transport. For example, if the environment is an IPv6 network, the IP Authentication Header [RFC4302] or IP Encapsulating Security Payload Header [RFC4303] can be used 🔑
The IOAM Capabilities information collected through queries may be considered confidential 🤫 An implementation can use a secure underlying transport for echo requests or replies to provide privacy protection. For example, if the environment is an IPv6 network, confidentiality can be achieved by using the IP Encapsulating Security Payload Header [RFC4303] 💜
An implementation can also secure the data carried in echo requests and replies directly if needed. How to secure the data is beyond the scope of this document 🧁
An implementation can also check whether the fields in received echo requests and replies strictly conform to the specifications. For example, it can check whether the list of IOAM Namespace-IDs includes duplicate entries, and whether the received Namespace-ID is an operator-assigned or IANA-assigned one. Once a check fails, an exception event indicating the checked field should be reported to the management 🚨
Except for what's described above, the security issues discussed in [RFC9197] provide good guidance on implementing this specification. Read it, bestie 📚💅
7. References 📖
7.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<https://www.rfc-editor.org/info/rfc2119>.
[RFC8126] Cotton, M., Leiba, B., and T. Narten, "Guidelines for
Writing an IANA Considerations Section in RFCs", BCP 26,
RFC 8126, DOI 10.17487/RFC8126, June 2017,
<https://www.rfc-editor.org/info/rfc8126>.
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
May 2017, <https://www.rfc-editor.org/info/rfc8174>.
[RFC9197] Brockners, F., Ed., Bhandari, S., Ed., and T. Mizrahi,
Ed., "Data Fields for In Situ Operations, Administration,
and Maintenance (IOAM)", RFC 9197, DOI 10.17487/RFC9197,
May 2022, <https://www.rfc-editor.org/info/rfc9197>.
[RFC9326] Song, H., Gafni, B., Brockners, F., Bhandari, S., and T.
Mizrahi, "In Situ Operations, Administration, and
Maintenance (IOAM) Direct Exporting", RFC 9326,
DOI 10.17487/RFC9326, November 2022,
<https://www.rfc-editor.org/info/rfc9326>.7.2. Informative References
[BIER-PING]
Nainar, N. K., Pignataro, C., Akiya, N., Zheng, L., Chen,
M., and G. Mirsky, "BIER Ping and Trace", Work in
Progress, Internet-Draft, draft-ietf-bier-ping-08, 6 March
2023, <https://datatracker.ietf.org/doc/html/draft-ietf-
bier-ping-08>.
[OAM-for-SFC]
Mirsky, G., Meng, W., Ao, T., Khasnabish, B., Leung, K.,
and G. Mishra, "Active OAM for Service Function Chaining
(SFC)", Work in Progress, Internet-Draft, draft-ietf-sfc-
multi-layer-oam-23, 23 March 2023,
<https://datatracker.ietf.org/doc/html/draft-ietf-sfc-
multi-layer-oam-23>.
[RFC4302] Kent, S., "IP Authentication Header", RFC 4302,
DOI 10.17487/RFC4302, December 2005,
<https://www.rfc-editor.org/info/rfc4302>.
[RFC4303] Kent, S., "IP Encapsulating Security Payload (ESP)",
RFC 4303, DOI 10.17487/RFC4303, December 2005,
<https://www.rfc-editor.org/info/rfc4303>.
[RFC4443] Conta, A., Deering, S., and M. Gupta, Ed., "Internet
Control Message Protocol (ICMPv6) for the Internet
Protocol Version 6 (IPv6) Specification", STD 89,
RFC 4443, DOI 10.17487/RFC4443, March 2006,
<https://www.rfc-editor.org/info/rfc4443>.
[RFC4620] Crawford, M. and B. Haberman, Ed., "IPv6 Node Information
Queries", RFC 4620, DOI 10.17487/RFC4620, August 2006,
<https://www.rfc-editor.org/info/rfc4620>.
[RFC4884] Bonica, R., Gan, D., Tappan, D., and C. Pignataro,
"Extended ICMP to Support Multi-Part Messages", RFC 4884,
DOI 10.17487/RFC4884, April 2007,
<https://www.rfc-editor.org/info/rfc4884>.
[RFC8029] Kompella, K., Swallow, G., Pignataro, C., Ed., Kumar, N.,
Aldrin, S., and M. Chen, "Detecting Multiprotocol Label
Switched (MPLS) Data-Plane Failures", RFC 8029,
DOI 10.17487/RFC8029, March 2017,
<https://www.rfc-editor.org/info/rfc8029>.
[RFC8335] Bonica, R., Thomas, R., Linkova, J., Lenart, C., and M.
Boucadair, "PROBE: A Utility for Probing Interfaces",
RFC 8335, DOI 10.17487/RFC8335, February 2018,
<https://www.rfc-editor.org/info/rfc8335>.
[RFC8799] Carpenter, B. and B. Liu, "Limited Domains and Internet
Protocols", RFC 8799, DOI 10.17487/RFC8799, July 2020,
<https://www.rfc-editor.org/info/rfc8799>.Acknowledgements 🫶
The authors would like to acknowledge Tianran Zhou, Dhruv Dhody,
Frank Brockners, Cheng Li, Gyan Mishra, Marcus Ihlar, Martin Duke,
Chris Lonvick, Éric Vyncke, Alvaro Retana, Paul Wouters, Roman
Danyliw, Lars Eggert, Warren Kumari, John Scudder, Robert Wilton,
Erik Kline, Zaheduzzaman Sarker, Murray Kucherawy, and Donald
Eastlake 3rd for their careful review and helpful comments.
The authors appreciate the f2f discussion with Frank Brockners on
this document.
The authors would like to acknowledge Tommy Pauly and Ian Swett for
their good suggestion and guidance.Authors' Addresses 💖
Xiao Min
ZTE Corp.
Nanjing
China
Phone: +86 25 88013062
Email: xiao.min2@zte.com.cn
Greg Mirsky
Ericsson
United States of America
Email: gregimirsky@gmail.com
Lei Bo
China Telecom
Beijing
China
Phone: +86 10 50902903
Email: leibo@chinatelecom.cn📦 where this page comes from
- ietf: rfc9359 2023-04
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms