RFC 9854
AODV-RPL: The Routing Protocol for Low-Power and Lossy Networks (RPL) Based on Ad Hoc On-Demand Distance Vector (AODV) Routing
RFC 9854 🦋 Part 1 of 8
AODV-RPL: The Routing Protocol for Low-Power and Lossy Networks (RPL) Based on Ad Hoc On-Demand Distance Vector (AODV) Routing 💖
okay bestie, let's get the basics down first. 🎀 This is RFC 9854, a Standards Track document (so it's an actual Internet standard, not just a vibe 💅), published October 2025. The ISSN is 2070-1721.
The authors are:
- C.E. Perkins from Blue Meadow Networks 🌸
- S.V.R. Anand from the Indian Institute of Science 🧚
- S. Anamalamudi from SRM University-AP ⭐
- B. Liu from Huawei Technologies 🌈
The title block has no Obsoletes or Updates line, so this doc isn't listed as replacing or changing any older RFC. Main character energy, no baggage 👑
Abstract ✨
ngl this abstract is so good. 😭 Route discovery for symmetric and asymmetric Peer-to-Peer (P2P) traffic flows is a feature everyone wants in Low-Power and Lossy Networks (LLNs). So this doc specifies AODV-RPL, which is the Routing Protocol for Low-Power and Lossy Networks (RPL) built on Ad hoc On-demand Distance Vector (AODV) routing. 🦋
AODV-RPL is a reactive P2P route discovery mechanism. It works for both hop-by-hop routes and source routing. When the links between a source and a target node are asymmetric, paired instances get used to build directional paths. It's giving clever engineering 🔥
Status of This Memo 🎀
This is an Internet Standards Track document. 💜
It's a product of the Internet Engineering Task Force (IETF) and represents the consensus of the IETF community. It went through public review and got approved for publication by the Internet Engineering Steering Group (IESG). If you want more info on Internet Standards, check Section 2 of RFC 7841.
For the current status, any errata, and how to send feedback, go to https://www.rfc-editor.org/info/rfc9854. 🌸
Copyright Notice 🌈
Copyright (c) 2025 IETF Trust and the persons identified as the document authors. All rights reserved. 🫶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as they stand on the publication date. Please read these carefully, because they spell out your rights and restrictions for this document. 📜
Code Components pulled out of this document must include Revised BSD License text, as described in Section 4.e of the Trust Legal Provisions. They come with no warranty, as described in the Revised BSD License. 💀
Table of Contents 🧚
1. Introduction
2. Terminology
3. Overview of AODV-RPL
4. AODV-RPL DIO Options
4.1. AODV-RPL RREQ Option
4.2. AODV-RPL RREP Option
4.3. AODV-RPL Target Option
5. Symmetric and Asymmetric Routes
6. AODV-RPL Operation
6.1. Generating RREQ
6.2. Receiving and Forwarding RREQ Messages
6.2.1. Step 1: RREQ Reception and Evaluation
6.2.2. Step 2: TargNode and Intermediate Router Determination
6.2.3. Step 3: Intermediate Router RREQ Processing
6.2.4. Step 4: Symmetric Route Processing at an Intermediate
Router
6.2.5. Step 5: RREQ Propagation at an Intermediate Router
6.2.6. Step 6: RREQ Reception at TargNode
6.3. Generating RREP at TargNode
6.3.1. RREP-DIO for Symmetric Route
6.3.2. RREP-DIO for Asymmetric Route
6.3.3. RPLInstanceID Pairing
6.4. Receiving and Forwarding RREP
6.4.1. Step 1: Receiving and Evaluation
6.4.2. Step 2: OrigNode or Intermediate Router
6.4.3. Step 3: Build Route to TargNode
6.4.4. Step 4: RREP Propagation
7. Gratuitous RREP
8. Operation of Trickle Timer
9. IANA Considerations
10. Security Considerations
11. References
11.1. Normative References
11.2. Informative References
Appendix A. Example: Using ETX/RSSI Values to Determine Value of S
Bit
Appendix B. Some Example AODV-RPL Message Flows
B.1. Example Control Message Flows in Symmetric and Asymmetric
Networks
B.2. Example RREP_WAIT Handling
B.3. Example G-RREP Handling
Acknowledgements
Contributors
Authors' Addresses1. Introduction 🍓
okay so, the Routing Protocol for Low-Power and Lossy Networks (RPL) [RFC6550] is an IPv6 distance vector routing protocol. 💅 It's built to support multiple traffic flows through a root-based Destination-Oriented Directed Acyclic Graph (DODAG).
Here's the tea 🫖: a router usually doesn't have routing info for destinations attached to most other routers. So when traffic goes between routers inside the DODAG (aka P2P traffic), the data packets either have to go all the way through the root in non-storing mode, or through a common ancestor in storing mode. That means P2P traffic tends to take longer routes and can get severely congested near the root. For more on this, see [RFC6687], [RFC6997], [RFC6998], and [RFC9010]. 😭
The network environment this document assumes is the same one described in Section 1 of [RFC6550]. Each radio interface/link and its associated address should be treated as an independent intermediate router. These routers have different links, so the link symmetry rules apply to each one separately. 🔥
The route discovery process in AODV-RPL is modeled on the matching P2P procedure in AODV [RFC3561]. The on-demand property of AODV route discovery is really useful for RPL-based LLNs when routes are needed but haven't been set up yet. 🦋 P2P routing is desirable because it can find shorter routes, especially when you want to avoid sending extra traffic through a root or gateway node. Some routes may need to be set up proactively, like when you know them ahead of time and AODV-RPL's route discovery would add unwanted delay when the application launches. ⏳
AODV terminology got adapted for the AODV-RPL messages: "RREQ" stands for "Route Request" and "RREP" stands for "Route Reply". 🌸 Compared to AODV, AODV-RPL leaves out some features. In particular, it doesn't do flagging of route errors, blocking the use of unidirectional links [RFC3561], multihoming, or handling of unnumbered interfaces. 🙈
AODV-RPL reuses and extends the core RPL functionality so it can support routes with bidirectional asymmetric links. 🌈 It keeps RPL's DODAG formation, the RPL Instance and its associated Objective Function (OF) (defined in [RFC6551]), Trickle timers, and support for both storing and non-storing modes. ✨
Here's the main move 👑: AODV-RPL adds the basic RREQ and RREP messages as part of the RPL DODAG Information Object (DIO) control message. They go in separate (paired) RPL Instances. AODV-RPL doesn't use the Destination Advertisement Object (DAO) control message of RPL at all. 🧚
AODV-RPL uses the "P2P Route Discovery Mode of Operation" (MOP == 4), with three new options for the DIO message that are dedicated to discovering P2P routes. These P2P routes may be different from the routes RPL [RFC6550] can find. 💜
Since AODV-RPL uses newly defined options and a newly allocated multicast group (see Section 9), it doesn't conflict with P2P-RPL [RFC6997], an older document that uses the same MOP. AODV-RPL can run whether or not P2P-RPL or RPL [RFC6550] is also running. 🎀
AODV-RPL could be used in networks that need routes with OFs that can't be satisfied by routes forced to go through the root of the network or other common ancestors. P2P routes often need fewer hops, so they use fewer resources than routes that go through the root or a common ancestor. 🫶
The cost is similar to base RPL [RFC6550], and it depends on a bunch of things, like how close the OrigNode and TargNodes are to each other and how the symmetric and asymmetric P2P links are distributed. 🤓
Last but not least, experience with AODV [aodv-tot] suggests that AODV-RPL will often find routes with improved Rank compared to routes that are constrained to traverse a common ancestor of the source and destination nodes. Absolutely iconic 🔥🦋👑
2. Terminology 📚
Okay bestie, the capital-letter key words are a big deal here. "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be read as described in BCP 14 [RFC2119] [RFC8174], but only when they show up in all capitals like that. 🫶
AODV-RPL reuses names for messages and data structures, including Rank, DODAG, and DODAGID, which are defined in RPL [RFC6550]. 🌸
This document also uses the following terms, so let's get into them 💅
- AODV: Ad hoc On-Demand Distance Vector [RFC3561].
- ART option: The AODV-RPL Target option defined in this document. 🎀
- Asymmetric route: The route from the OrigNode to the TargNode can go through different nodes than the route from the TargNode to the OrigNode. An asymmetric route can happen because of link asymmetry, so only one direction of the series of links satisfies the OF during route discovery. 🙈
- Bidirectional asymmetric link: A link that can be used in both directions, but the two directions have different link characteristics. 🦋
- DIO: DODAG Information Object (as defined in [RFC6550]).
- DODAG RREQ-Instance (or simply RREQ-Instance): A RPL Instance built using the DIO with RREQ option. It's used to send control messages from OrigNode to TargNode, which then enables data transmission from TargNode to OrigNode. 🧚
- DODAG RREP-Instance (or simply RREP-Instance): A RPL Instance built using the DIO with RREP option. It's used to send control messages from TargNode to OrigNode, which then enables data transmission from OrigNode to TargNode. 🌈
- Downward direction: The direction from the OrigNode to the TargNode.
- Downward route: A route in the downward direction.
- Hop-by-hop route: A route where each router along the routing path stores routing information about the next hop. A hop-by-hop route is created using RPL's "storing mode". 🍓
- OF: Objective Function (as defined in [RFC6550]).
- OrigNode: The IPv6 router (originating node) that starts the AODV-RPL route discovery to get a route to TargNode. 👑
- Paired DODAGs: Two DODAGs for a single route discovery process between OrigNode and TargNode. ✨
- P2P: Peer-to-Peer (in other words, not constrained a priori to traverse a common ancestor). 💜
- REJOIN_REENABLE: The duration during which a node is not allowed to join a DODAG with a particular RREQ-InstanceID, after it has left a DODAG with the same RREQ-InstanceID. The default value of
REJOIN_REENABLEis 15 minutes. ⏰ - RREQ: Route Request.
- RREQ-DIO message: A DIO message containing the RREQ option. The
RPLInstanceIDin RREQ-DIO is assigned locally by the OrigNode. The RREQ-DIO message has a secure variant as noted in [RFC6550]. 🔥 - RREQ-InstanceID: The
RPLInstanceIDfor the RREQ-Instance. The RREQ-InstanceID is formed as the ordered pair (Orig_RPLInstanceID,OrigNode-IPaddr), whereOrig_RPLInstanceIDis the localRPLInstanceIDallocated by OrigNode andOrigNode-IPaddris an IP address of OrigNode. The RREQ-InstanceID uniquely identifies the RREQ-Instance. 🥹 - RREP: Route Reply.
- RREP-DIO message: A DIO message containing the RREP option. OrigNode pairs the
RPLInstanceIDin RREP-DIO with the one in the associated RREQ-DIO message (that is, the RREQ-InstanceID), as described in Section 6.3.2. The RREP-DIO message has a secure variant as noted in [RFC6550]. 🫧 - RREP-InstanceID: The
RPLInstanceIDfor the RREP-Instance. The RREP-InstanceID is formed as the ordered pair (Targ_RPLInstanceID,TargNode-IPaddr), whereTarg_RPLInstanceIDis the localRPLInstanceIDallocated by TargNode andTargNode-IPaddris an IP address of TargNode. The RREP-InstanceID uniquely identifies the RREP-Instance. TheRPLInstanceIDin the RREP message, along with the Delta value, indicates the associated RREQ-InstanceID. The InstanceIDs are matched by the mechanism explained in Section 6.3.3. 🎯 - Source routing: A mechanism where the source gives a vector of addresses toward the destination node along with each data packet [RFC6550]. 🗺️
- Symmetric route: The upstream and downstream routes go through the same routers and over the same links. 🪞
- TargNode: The IPv6 router (target node) that OrigNode needs a route to, and that starts route discovery within the LLN. 🎯
- Upward direction: The direction from the TargNode to the OrigNode.
- Upward route: A route in the upward direction.
3. Overview of AODV-RPL 🌊
Okay so with AODV-RPL, routes from OrigNode to TargNode inside the LLN don't get set up until they're actually needed. 🙌 The route discovery mechanism in AODV-RPL kicks in when OrigNode has data to deliver to a TargNode, but the routes that already exist don't meet the application's requirements. That's why AODV-RPL counts as an "on-demand" routing protocol. These are also called "reactive" routing protocols, since they only act in reaction to figuring out that a new route is needed. Main character energy, honestly 💅 AODV-RPL also works without needing RPL or any other routing protocol. ✨
The routes AODV-RPL discovers aren't required to go through a common ancestor. AODV-RPL can make asymmetric communication paths possible in networks that have bidirectional asymmetric links. To do that, AODV-RPL discovers two routes: one from OrigNode to TargNode, and another from TargNode to OrigNode. 🦋 AODV-RPL also discovers symmetric routes along paired DODAGs, but only when symmetric routes are possible (see Section 5). 🫶
Here's how it goes. In AODV-RPL, routes are discovered by first building a temporary Directed Acyclic Graph (DAG) rooted at the OrigNode. Paired DODAGs (Instances) get built during route formation between the OrigNode and TargNode. The RREQ-Instance is formed by route control messages going from OrigNode to TargNode, while the RREP-Instance is formed by route control messages going from TargNode to OrigNode. The route discovered in the RREQ-Instance is used to send data from TargNode to OrigNode, and the route discovered in the RREP-Instance is used to send data from OrigNode to TargNode. It's giving two-way street 🛣️
Intermediate routers join the DODAGs based on the Rank [RFC6550], as calculated from the DIO messages. AODV-RPL uses the same notion of Rank as defined in [RFC6550]:
The Rank is the expression of a relative position within a DODAG
Version with regard to neighbors, and it is not necessarily a good
indication or a proper expression of a distance or a path cost to
the root.So, the Rank measurements provided in AODV messages don't indicate a distance or a path cost to the root. Don't get it twisted 🙈
Now, from here on in this document, "RREQ-DIO message" means the DIO message from OrigNode toward TargNode, which contains the RREQ option as specified in Section 4.1. The RREQ-InstanceID is formed as the ordered pair (Orig_RPLInstanceID, OrigNode-IPaddr), where Orig_RPLInstanceID is the local RPLInstanceID allocated by OrigNode and OrigNode-IPaddr is the IP address of OrigNode. A node that receives the RREQ-DIO can use the RREQ-InstanceID to identify the proper OF whenever it receives a data packet with Source Address == OrigNode-IPaddr and an IPv6 RPL Option that has RPLInstanceID == Orig_RPLInstanceID. The D bit of the RPLInstanceID field is set to 0 to show that the source address of the IPv6 packet is the DODAGID. 🔍
Similarly, "RREP-DIO message" means the DIO message from TargNode toward OrigNode, which contains the RREP option as specified in Section 4.2. The RREP-InstanceID is formed as the ordered pair (Targ_RPLInstanceID, TargNode-IPaddr), where Targ_RPLInstanceID is the local RPLInstanceID allocated by TargNode and TargNode-IPaddr is the IP address of TargNode. A node that receives the RREP-DIO can use the RREP-InstanceID to identify the proper OF whenever it receives a data packet with Source Address == TargNode-IPaddr and an IPv6 RPL Option that has RPLInstanceID == Targ_RPLInstanceID along with D == 0, same as above. 💖
4. AODV-RPL DIO Options ✨
4.1. AODV-RPL RREQ Option ✨
okay so OrigNode picks one of its IPv6 addresses and drops it into the DODAGID field of the RREQ-DIO message 💅. The address scope of that address MUST encompass the domain where the route is built (e.g, not link-local), otherwise the route discovery will fail 💀. Exactly one RREQ option MUST be present in an RREQ-DIO message, otherwise the message MUST be dropped 🙈.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option Type | Option Length |S|H|X| Compr | L | RankLimit |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Orig SeqNo | |
+-+-+-+-+-+-+-+-+ |
| |
| Address Vector (Optional, Variable Length) |
. .
. .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ . . .Figure 1: Format for AODV-RPL RREQ Option
OrigNode supplies the following information in the RREQ option:
Option Type 🎀 8-bit unsigned integer specifying the type of the option (0x0B).
Option Length 🌸 8-bit unsigned integer specifying the length of the option in octets, excluding the Option Type and Option Length fields. It is variable due to the presence of the Address Vector and the number of octets elided according to the Compr value.
S 🦋 Symmetric bit indicating a symmetric route from the OrigNode to the router transmitting this RREQ-DIO. See Section 5.
H 💜 Set to one for a hop-by-hop route. Set to zero for a source route. This flag controls both the downstream route and upstream route.
X 🧚 Reserved. This field MUST be initialized to zero and ignored upon reception.
Compr ✨ 4-bit unsigned integer. When Compr is nonzero, exactly that number of prefix octets MUST be elided from each address before storing it in the Address Vector. The octets elided are shared with the IPv6 address in the DODAGID. This field is only used in source routing mode (H=0). In hop-by-hop mode (H=1), this field MUST be set to zero and ignored upon reception.
L ⏳ 2-bit unsigned integer determining the time duration that a node is able to belong to the RREQ-Instance (a temporary DAG including the OrigNode and the TargNode). Once the time is reached, a node SHOULD leave the RREQ-Instance and stop sending or receiving any more DIOs for the RREQ-Instance; otherwise, memory and network resources are likely to be consumed unnecessarily. This naturally depends on the node's ability to keep track of time. Once a node leaves an RREQ-Instance, it MUST NOT rejoin the same RREQ-Instance for at least the time interval specified by the configuration variable REJOIN_REENABLE. L is independent from the route lifetime, which is defined in the DODAG configuration option.
0x00: No time limit imposed0x01: 16 seconds0x02: 64 seconds0x03: 256 seconds
RankLimit 🌈 8-bit unsigned integer specifying the upper limit on the integer portion of the Rank (calculated using the DAGRank() macro defined in [RFC6550]). A value of 0 in this field indicates the limit is infinity.
Orig SeqNo 🔢 8-bit unsigned integer specifying the Sequence Number of OrigNode. See Section 6.1.
Address Vector 🗺️ A vector of IPv6 addresses representing the route that the RREQ-DIO has passed. It is only present when the H bit is set to 0. The prefix of each address is elided according to the Compr field.
TargNode can join the RREQ-Instance at a Rank whose integer portion is less than or equal to the RankLimit. Any other node MUST NOT join an RREQ-Instance if its own Rank would be equal to or higher than the RankLimit. A router MUST discard a received RREQ if the integer part of the advertised Rank equals or exceeds the RankLimit.
4.2. AODV-RPL RREP Option 💖
TargNode sets one of its IPv6 addresses in the DODAGID field of the RREP-DIO message. The address scope of the selected address must encompass the domain where the route is built (e.g, not link-local). Exactly one RREP option MUST be present in an RREP-DIO message, otherwise, the message MUST be dropped. TargNode supplies the following information in the RREP option:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option Type | Option Length |G|H|X| Compr | L | RankLimit |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Delta |X X| |
+-+-+-+-+-+-+-+-+ |
| |
| |
| Address Vector (Optional, Variable Length) |
. .
. .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ . . .Figure 2: Format for AODV-RPL RREP Option
Option Type 🎀 8-bit unsigned integer specifying the type of the option (0x0C).
Option Length 🌸 8-bit unsigned integer specifying the length of the option in octets, excluding the Option Type and Option Length fields. It is variable due to the presence of the Address Vector and the number of octets elided according to the Compr value.
G 🌟 Gratuitous RREP (see Section 7).
H 💜 The H bit in the RREP option MUST be set to be the same as the H bit in the RREQ option. It requests either source routing (H=0) or hop-by-hop (H=1) for the downstream route.
X 🧚 1-bit Reserved field. This field MUST be initialized to zero and ignored upon reception.
Compr ✨ 4-bit unsigned integer. This field has the same definition as in the RREQ option.
L ⏳ 2-bit unsigned integer defined as in the RREQ option. The lifetime of the RREP-Instance SHOULD be no greater than the lifetime of the RREQ-Instance to which it is paired, so that the memory required to store the RREP-Instance can be reclaimed when no longer needed.
RankLimit 🌈 8-bit unsigned integer specifying the upper limit on the integer portion of the Rank, similarly to RankLimit in the RREQ message. A value of 0 in this field indicates the limit is infinity.
Delta 🍓 6-bit unsigned integer. TargNode uses the Delta field so that nodes receiving its RREP message can identify the RREQ-InstanceID of the RREQ message that triggered the transmission of the RREP (see Section 6.3.3).
X X 🫶 2-bit Reserved field. This field MUST be initialized to zero and ignored upon reception.
Address Vector 🗺️ Only present when the H bit is set to 0. The prefix of each address is elided according to the Compr field. For an asymmetric route, the Address Vector represents the IPv6 addresses of the path through the network the RREP-DIO has passed. In contrast, for a symmetric route, it is the Address Vector when the RREQ-DIO arrives at the TargNode, unchanged during the transmission to the OrigNode.
4.3. AODV-RPL Target Option 🦋
okay the AODV-RPL Target (ART) option is based on the Target option in the core RPL specification [RFC6550]. The Flags field is replaced by the Destination Sequence Number of the TargNode, and the Prefix Length field is reduced to 7 bits so that the value is limited to be no greater than 127 🙌.
An RREQ-DIO message MUST carry at least one ART option. An RREP-DIO message MUST carry exactly one ART option. Otherwise, the message MUST be dropped 😭.
OrigNode can include multiple TargNode addresses via multiple ART options in the RREQ-DIO, for routes that share the same requirement on metrics. This reduces the cost to building only one DODAG for multiple targets.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Option Type | Option Length | Dest SeqNo |X|Prefix Length|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
+ |
| Target Prefix / Address (Variable Length) |
. .
. .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ . . .Figure 3: ART Option Format for AODV-RPL
Option Type 🎀 8-bit unsigned integer specifying the type of the option (0x0D).
Option Length 🌸 8-bit unsigned integer specifying the length of the option in octets, excluding the Option Type and Option Length fields.
Dest SeqNo 🔢 8-bit unsigned integer. In RREQ-DIO, if nonzero, it is the Sequence Number for the last route that OrigNode stored to the TargNode for which a route is desired. In RREP-DIO, it is the Destination Sequence Number associated to the route. Zero is used if there is no known information about the Sequence Number of TargNode and not used otherwise.
X 🧚 1-bit Reserved field. This field MUST be initialized to zero by the sender and MUST be ignored by the receiver.
Prefix Length 📏 7-bit unsigned integer. The Prefix Length field contains the number of valid leading bits in the prefix. If Prefix Length is 0, then the value in the Target Prefix / Address field represents an IPv6 address, not a prefix.
Target Prefix / Address 🎯 A variable-length field with an IPv6 destination address or prefix. The length of the Target Prefix / Address field is the least number of octets that can represent all of the bits of the Prefix, in other words, Ceil(Prefix Length/8) octets. When Prefix Length is not equal to 8*Ceil(Prefix Length/8) and nonzero, the Target Prefix / Address field will contain some initial bits that are not part of the Target Prefix. Those initial bits (if any) MUST be set to zero on transmission and MUST be ignored on receipt. If Prefix Length is zero, the Address field is 128 bits.
5. Symmetric and Asymmetric Routes ✨
Okay so, links are considered symmetric until indication to the contrary is received 🦋. In Figures 4 and 5, BR is the Border Router, O is the OrigNode, each R is an intermediate router, and T is the TargNode. BR is only in these pictures to make things clearer, because AODV does not depend on border routers to work 💅.
If the RREQ-DIO arrives over an interface that is known to be symmetric and the S bit is set to 1, then it stays at 1, as you can see in Figure 4 🌸. If an intermediate router sends out an RREQ-DIO with the S bit set to 1, then every link en route from the OrigNode O to that router has met the requirements of route discovery, so the route can be used symmetrically. Iconic 👑.
BR
/----+----\
/ | \
/ | \
R R R
_/ \ | / \
/ \ | / \
/ \ | / \
R -------- R --- R ----- R -------- R
/ \ <--S=1--> / \ <--S=1--> / \
<--S=1--> \ / \ / <--S=1-->
/ \ / \ / \
O ---------- R ------ R------ R ----- R ----------- T
/ \ / \ / \ / \
/ \ / \ / \ / \
/ \ / \ / \ / \
R ----- R ----------- R ----- R ----- R ----- R ---- R----- R
>---- RREQ-Instance (Control: O-->T; Data: T-->O) ------->
<---- RREP-Instance (Control: T-->O; Data: O-->T) -------<
Figure 4: AODV-RPL with Symmetric InstancesOkay, so when a node gets an RREQ-DIO with the S bit set to 1, it has to check whether the link it came over can actually be used symmetrically 🧚. That means both directions have to meet the requirements of data transmission. If the RREQ-DIO arrives over an interface that isn't known to be symmetric, or is known to be asymmetric, the S bit gets set to 0. If the S bit shows up already set to 0, it stays 0 when the RREQ-DIO is propagated (see Figure 5) 🍓. For an asymmetric route, there's at least one hop that doesn't satisfy the OF. So based on the S bit it got in the RREQ-DIO, TargNode T figures out whether the route is symmetric before it sends the RREP-DIO message upstream toward the OrigNode O 💜.
It's beyond the scope of this document to spell out the criteria for deciding whether each link is symmetric, so don't stress about that part 🙈. As an example, intermediate routers can use local information (e.g., bit rate, bandwidth, number of cells used in 6TiSCH [RFC9030]), a priori knowledge (e.g., link quality according to previous communication), or averaging techniques, whatever fits the application. Other link metric info can be collected before AODV-RPL runs, by doing evaluation procedures. For instance, test traffic can be generated between nodes of the deployed network. While AODV-RPL is running, Operations, Administration, and Maintenance (OAM) techniques for evaluating link state (see [RFC7548], [RFC7276], and [co-ioam]) MAY be used, at regular intervals that suit the LLN 🌈. The evaluation procedures themselves are out of scope for AODV-RPL. If you want to go deeper, check out [Link_Asymmetry], [low-power-wireless], and [empirical-study] 📚.
Appendix A describes an example method that uses the upstream Expected Transmission Count (ETX) and the downstream Received Signal Strength Indicator (RSSI) to estimate whether a link is symmetric in terms of link quality, using an averaging technique 🎀.
BR
/----+----\
/ | \
/ | \
R R R
/ \ | / \
/ \ | / \
/ \ | / \
R --------- R --- R ---- R --------- R
/ \ --S=1--> / \ --S=0--> / \
--S=1--> \ / \ / --S=0-->
/ \ / \ / \
O ---------- R ------ R------ R ----- R ----------- T
/ \ / \ / \ / \
/ <--S=0-- / \ / \ / <--S=0--
/ \ / \ / \ / \
R ----- R ----------- R ----- R ----- R ----- R ---- R----- R
<--S=0-- <--S=0-- <--S=0-- <--S=0-- <--S=0--
>---- RREQ-Instance (Control: O-->T; Data: T-->O) ------->
<---- RREP-Instance (Control: T-->O; Data: O-->T) -------<
Figure 5: AODV-RPL with Asymmetric Paired InstancesAs Figure 5 shows, an intermediate router decides which S bit value the RREQ-DIO should carry by using the link asymmetry detection methods we talked about earlier in this section 🦋. Usually, by the time the RREQ-DIO shows up, that router has already made its link asymmetry call, so it's not a last-minute scramble 💅.
For examples of RREQ and RREP transmissions in some networks with symmetric and asymmetric links, check out Appendix B 🌸.
6. AODV-RPL Operation
6.1. Generating RREQ
Route discovery kicks off when an application at the OrigNode has data for the TargNode but doesn't have a route that satisfies the OF for the target of that data 🚀. In that case, the OrigNode builds a local RPL Instance and a DODAG rooted at itself. Then it sends a DIO message with exactly one RREQ option (see Section 4.1) to the multicast group all-AODV-RPL-nodes. The RREQ-DIO MUST contain at least one ART option (see Section 4.3), which indicates the TargNode. The S bit in the RREQ-DIO that the OrigNode sends out is set to 1 ✨.
Every node keeps a Sequence Number, and the operation for that is specified in Section 7.2 of [RFC6550] 🧚. When the OrigNode starts a route discovery process, it MUST increase its own Sequence Number so it doesn't clash with routes that were already set up 💖. The Sequence Number gets carried in the Orig SeqNo field of the RREQ option.
The Target Prefix / Address in the ART option can be a unicast IPv6 address or a prefix 🌈. The OrigNode can run route discovery for multiple targets at once by including multiple ART options. Within one RREQ-DIO, the OF for the routes to different TargNodes MUST be the same 👑.
The OrigNode can keep different RPL Instances to find routes with different requirements to the same targets 🦋. Using the RPLInstanceID pairing mechanism (see Section 6.3.3), route replies (RREP-DIOs) for different RPL Instances can be generated 💜.
Sending RREQ-DIOs follows the Trickle timer [RFC6206] 🌸. If the duration given by the L field has elapsed, the OrigNode MUST leave the DODAG and stop sending RREQ-DIOs in the related RPL Instance 😭. The OrigNode needs to set the L field so the DODAG won't time out too early while data is moving with the TargNode 🫶. To pick that value, it has to think about things like the Trickle timer, the TargNode hop distance, network size, link behavior, expected data usage time, and so on 🍓.
6.2. Receiving and Forwarding RREQ Messages
6.2.1. Step 1: RREQ Reception and Evaluation
When a router X gets an RREQ message over a link from a neighbor Y, X first checks whether the RREQ is valid 🔥. If it is, X then checks whether it has enough resources to maintain the RREQ-Instance, plus the S bit value it needs to process an eventual RREP if one comes back 💅. If the RREQ isn't valid, X MUST either free up enough resources (how to do that is beyond the scope of this document), or drop the packet and stop processing the RREQ 💀. Otherwise, X moves on to figure out whether the RREQ advertises a usable route to the OrigNode, by checking whether the link to Y can be used to transmit packets to the OrigNode ✨.
When H=0 in the incoming RREQ, the router MUST drop the RREQ-DIO if one of its addresses is present in the Address Vector 🙈. When H=1 in the incoming RREQ, the router MUST drop the RREQ message if the Orig SeqNo field of the RREQ is older than the SeqNo value that X has stored for a route to the OrigNode 😤. Otherwise, the router decides whether to propagate the RREQ-DIO. It does this by checking whether a route to the OrigNode, using the upstream direction of the incoming link, satisfies the Objective Function (OF) 🎀. To evaluate the OF, the router first works out the maximum useful Rank (MaxUsefulRank). If the router has already joined the RREQ-Instance associated with the RREQ-DIO, then MaxUsefulRank is set to the Rank value that was stored when the router processed the best previous RREQ for the DODAG with that RREQ-Instance. Otherwise, MaxUsefulRank is set to RankLimit. If the OF can't be satisfied (i.e., the Rank evaluates to a value greater than MaxUsefulRank), the RREQ-DIO MUST be dropped, and the following steps are not processed 💔. Otherwise, the router MUST join the RREQ-Instance and get ready to propagate the RREQ-DIO, as follows 🥳. The upstream neighbor router that sent the received RREQ-DIO is selected as the preferred parent in the RREQ-Instance 👑.
6.2.2. Step 2: TargNode and Intermediate Router Determination ✨
Okay so once a router has figured out that a received RREQ gives it a usable route to OrigNode, it has to work out what it actually is 💅. It could be a TargNode, a possible intermediate router between OrigNode and a TargNode, or both.
A router is a TargNode if it spots one of its own addresses inside a Target option in the RREQ 🎯. After it maybe passes the RREQ along through Steps 3, 4, and 5, the TargNode makes an RREP like Section 6.3 describes 🦋. And if S=0, figuring out TargNode status and figuring out a usable route to OrigNode are literally the same thing 🙈.
If OrigNode tries to reach multiple TargNodes in one RREQ-Instance, one of those TargNodes can be an intermediate router for the others 🧚. Here's the rule: before it sends the RREQ-DIO to multicast group all-AODV-RPL-nodes, a TargNode MUST delete the Target option encapsulating its own address. That way, downstream routers with higher Rank values don't try to build a route to this TargNode 🫶.
An intermediate router could get several RREQ-DIOs from routers with lower Rank values in the same RREQ-Instance, each with different lists of Target options 🌸. To figure out the intersection with the earlier RREQ-DIOs, it keeps a record of the targets requested for that RREQ-Instance. An incoming RREQ-DIO with multiple ART options from a router with a higher Rank than the Rank of the stored targets gets ignored 🙅. When transmitting the RREQ-DIO, the intersection of all received lists MUST be included if it's nonempty after the TargNode has deleted the Target option encapsulating its own address. If the intersection is empty, all the targets have been reached, so the router MUST NOT transmit any RREQ-DIO 💀. Otherwise, it moves on to Section 6.2.3.
Here's an example 👀. Suppose two RREQ-DIOs come in with the same RPL Instance and OrigNode. The first RREQ has (T1, T2) as its targets, and the second one has (T2, T4). Then only T2 needs to go into the generated RREQ-DIO ✨.
So why do we use the intersection? When two or more RREQs arrive with the same Orig SeqNo, OrigNode sent them with the same destinations and OF 🧠. If an intermediate node sees two RREQs with the same Orig SeqNo but different lists of destinations, it means some intermediate nodes that retransmitted those RREQs had already deleted themselves from the list before they sent it on. Those deleted nodes are not to be put back into the list 🚫.
6.2.3. Step 3: Intermediate Router RREQ Processing 🌈
The intermediate router makes itself a viable node for a route to OrigNode like this. If the H bit is set to 1, for a hop-by-hop route, then the router MUST build or update its upward route entry towards OrigNode. That entry includes at least these items:
- Source Address
- RPLInstanceID
- Destination Address
- Next Hop
- Lifetime
- Sequence Number
The Destination Address and the RPLInstanceID can be learned from the DODAGID and the RPLInstanceID of the RREQ-DIO, respectively. The Source Address is the address the router uses to send data to the Next Hop, which is the preferred parent 👑. The lifetime is set according to DODAG configuration (not the L field), and it can be extended when the route is actually used ⏳. The Sequence Number tells you how fresh the route entry is, and it's copied from the Orig SeqNo field of the RREQ option 🍓.
A route entry with the same source and destination address and the same RPLInstanceID, but a stale Sequence Number (meaning the incoming Sequence Number is less than the currently stored one), MUST be deleted 🗑️.
6.2.4. Step 4: Symmetric Route Processing at an Intermediate Router 🪞
If the S bit of the incoming RREQ-DIO is 0, then the route cannot be symmetric, and the S bit of the RREQ-DIO to be transmitted is set to 0. Otherwise, the router MUST determine whether the downward direction (towards the TargNode) of the incoming link satisfies the OF. If it does, the S bit of the RREQ-DIO to be transmitted is set to 1. If not, it's set to 0 💖.
When a router joins the RREQ-Instance, it also records, in its data structure for that RREQ-Instance, whether or not the RREQ-DIO to be transmitted has the S bit set to 1. This info is known as the S bit of the RREQ-Instance, and it gets used later during RREP-DIO processing (see Section 6.3.2) 📚.
Now suppose a router has joined the RREQ-Instance, the H bit is set to 0, and the S bit of the RREQ-Instance is set to 1. In that case, the router MAY optionally include the Address Vector of the symmetric route back to OrigNode as part of the RREQ-Instance data. This is useful if the router later receives an RREP-DIO that's paired with the RREQ-Instance 🦋. If the router does NOT include the Address Vector, then it has to rely on multicast for the RREP, and multicast can impose a substantial performance penalty 🐌.
6.2.5. Step 5: RREQ Propagation at an Intermediate Router 📣
If the router is an intermediate router, it transmits the RREQ-DIO to multicast group all-AODV-RPL-nodes. If the H bit is set to 0, the intermediate router MUST append the address of its interface receiving the RREQ-DIO into the Address Vector. On top of that, if the address of the router's interface transmitting the RREQ-DIO is not the same as the address of the interface receiving it, the router MUST also append the transmitting interface address into the Address Vector 🎀.
6.2.6. Step 6: RREQ Reception at TargNode 🎉
If the router is a TargNode and was already associated with the RREQ-Instance, it takes no further action and does not send an RREP-DIO 🙆. If the TargNode is not already associated with the RREQ-Instance, it prepares and transmits an RREP-DIO, possibly after waiting for RREP_WAIT_TIME, as detailed in (Section 6.3) ⏰.
6.3. Generating RREP at TargNode 🎀
When a TargNode receives an RREQ message over a link from a neighbor Y, it first follows the procedures in Section 6.2. If the link to Y can be used to transmit packets to OrigNode, the TargNode generates an RREP according to Sections 6.3.1 and 6.3.2. Otherwise, the TargNode drops the RREQ and does not generate an RREP 🙃.
If the L field is not 0, the TargNode MAY delay transmitting the RREP-DIO for the duration RREP_WAIT_TIME to wait for a route with a lower Rank 🕰️. The value of RREP_WAIT_TIME is set by default to 1/4 of the duration determined by the L field. For L == 0, RREP_WAIT_TIME is set by default to 0. Depending on the application, RREP_WAIT_TIME may be set to other values. Smaller values enable quicker formation of the P2P route, and larger values enable formation of P2P routes with better Rank values ⚡.
The address of the OrigNode MUST be encapsulated in the ART option, and it's included in this RREP-DIO message along with the SeqNo of the TargNode 💌.
6.3.1. RREP-DIO for Symmetric Route 💞
If the RREQ-Instance corresponding to the RREQ-DIO that arrived at the TargNode has the S bit set to 1, there's a symmetric route, and both of its directions satisfy the OF. Other RREQ-DIOs might later provide better upward routes. How to choose between a qualified symmetric route and an asymmetric route that might perform better is implementation specific and out of scope 🤷.
For a symmetric route, the RREP-DIO message is unicast to the Next Hop according to the Address Vector (H=0) or the route entry (H=1). The DODAG in the RREP-Instance does not need to be built. The RPLInstanceID in the RREP-Instance is paired as defined in Section 6.3.3. If the H bit is set to 0, the Address Vector from the RREQ-DIO MUST be included in the RREP-DIO 🫶.
6.3.2. RREP-DIO for Asymmetric Route ✈️
When an RREQ-DIO arrives at a TargNode with the S bit set to 0, the TargNode MUST build a DODAG in the RREP-Instance corresponding to the RREQ-DIO, rooted at itself. This gives OrigNode a downstream route to the TargNode 🗺️. The RREP-DIO message is transmitted to multicast group all-AODV-RPL-nodes.
6.3.3. RPLInstanceID Pairing 🧩
The RPLInstanceID is assigned locally (there's no coordination between routers when assigning it), so the tuple (OrigNode, TargNode, RPLInstanceID) is needed to uniquely identify a discovered route 🔑. Multiple route discoveries with dissimilar OFs can be started at the same time, so between the same pair of OrigNode and TargNode, there can be multiple AODV-RPL route discovery instances 👯. To avoid any mismatch, they MUST pair the RREQ-Instance and the RREP-Instance in the same route discovery by using the RPLInstanceID.
When preparing the RREP-DIO, a TargNode could find that the RPLInstanceID candidate for the RREP-Instance is already occupied by another RPL Instance from an earlier route discovery that's still active. This is unlikely, and it might happen if two distinct OrigNodes need routes to the same TargNode and happen to use the same RPLInstanceID for their RREQ-Instance 😬. In that case, the RPLInstanceID of an already active RREP-Instance MUST NOT be used again for the later RREP-Instance. If the same RPLInstanceID were reused for two distinct DODAGs originated with the same DODAGID (the TargNode address), intermediate routers couldn't tell those DODAGs (and their associated OFs) apart. So the RPLInstanceID MUST be replaced by another value, which lets the two RREP-Instances be distinguished 🌈.
In the RREP-DIO option, the Delta field of the RREP-DIO message (Figure 2) shows the value that the TargNode adds to the RPLInstanceID in the RREQ-DIO it received, to get the RPLInstanceID it uses in the RREP-DIO message. A 0 means the RREQ-InstanceID has the same value as the RPLInstanceID of the RREP message. When the new RPLInstanceID after incrementation exceeds 255, it rolls over, starting at 0 🔄. For example, if the RREQ-InstanceID is 252 and gets incremented by 6, the new RPLInstanceID will be 2. Related operations can be found in Section 6.4 📎.
RPLInstanceID collisions do not occur across RREQ-DIOs. The DODAGID equals the OrigNode address, and that's enough to tell DODAGs apart 💜.
6.4. Receiving and Forwarding RREP 📨
When a router receives an RREP-DIO, a router that already belongs to the RREP-Instance SHOULD drop the RREP-DIO 🙅♀️. Otherwise, the router performs the steps in the following subsections 🧚.
6.4.1. Step 1: Receiving and Evaluation ✨
Okay, first thing the router does when an RREP-DIO shows up is check the OF 👀. If the OF is not satisfied, the router MUST NOT join the DODAG 🙅♀️. It MUST discard the RREP-DIO and does not run the remaining steps in this section. An intermediate router MUST discard an RREP if one of its addresses is in the Address Vector, and it skips the remaining steps here too 💅.
If the S bit of the associated RREQ-Instance is set to 1, the router MUST proceed to Section 6.4.2 🎀.
If the S bit of the RREQ-Instance is set to 0, the router MUST determine two things. First, does the downward direction of the link (towards the TargNode) that the RREP-DIO came in on satisfy the OF? Second, would the router's Rank stay at or under the RankLimit? If both are true, the router joins the DODAG of the RREP-Instance 🦋. The router that sent the RREP-DIO becomes the preferred parent. After that, other RREP-DIO messages can still roll in, but AODV-RPL doesn't say what to do about them 🤷♀️.
6.4.2. Step 2: OrigNode or Intermediate Router 🌸
The router updates its stored value of the TargNode's Sequence Number using whatever the ART option says. Then it checks whether one of its addresses is included in the ART option. If it is, this router is the OrigNode of the route discovery 👑. If not, it's an intermediate router.
6.4.3. Step 3: Build Route to TargNode 🧚
If the H bit is set to 1, then the router (whether it's the OrigNode or an intermediate router) MUST build a downward route entry towards TargNode. The entry has to include at least these items: OrigNode Address, RPLInstanceID, TargNode Address as destination, Next Hop, Lifetime, and Sequence Number 📝.
For a symmetric route, the Next Hop in the route entry is the router the RREP-DIO came from. For an asymmetric route, the Next Hop is the preferred parent in the DODAG of RREP-Instance.
The RPLInstanceID in the route entry MUST be the RREQ-InstanceID, which means you subtract the Delta field value from the RPLInstanceID. The source address is learned from the ART option, and the destination address is learned from the DODAGID. The lifetime is set by the DODAG configuration (not the L field), and it can be extended when the route actually gets used ⏳. The Sequence Number shows how fresh the route entry is, and it gets copied from the Dest SeqNo field of the ART option in the RREP-DIO 💖. A route entry with the same source and destination address and the same RPLInstanceID, but a stale Sequence Number, MUST be deleted 🗑️.
6.4.4. Step 4: RREP Propagation 💫
If the receiver is the OrigNode, it can start sending application data to TargNode along the path given in RREP-Instance, and processing for the RREP-DIO is done 🎉. Otherwise, the RREP gets propagated towards OrigNode.
If H=0, the intermediate router MUST include the address of the interface that received the RREP-DIO into the Address Vector. If H=1, then from the previous step, the intermediate router has already set up a route entry for TargNode. If the intermediate router has a route to OrigNode, it uses that route to unicast the RREP-DIO to OrigNode. Otherwise, for a symmetric route, the RREP-DIO is unicast to the Next Hop, following the Address Vector in the RREP-DIO (H=0) or the local route entry (H=1). For an asymmetric route, the intermediate router sends the RREP-DIO to the multicast group all-AODV-RPL-nodes. The RPLInstanceID in the transmitted RREP-DIO is the same as the value in the received RREP-DIO 🔁.
7. Gratuitous RREP 🎀
In some cases, an intermediate router that receives an RREQ-DIO message MAY unicast a Gratuitous RREP-DIO (G-RREP-DIO) message back to OrigNode before it keeps passing the RREQ-DIO on towards TargNode. The Gratuitous RREP (G-RREP) lets the OrigNode start sending data to TargNode sooner 🚀. The G bit of the RREP option tells the G-RREP-DIO (G=1) sent by the intermediate router apart from the RREP-DIO sent by TargNode (G=0).
The G-RREP-DIO MAY be sent out when the intermediate router receives an RREQ-DIO for a TargNode, and the router has a pair of downward and upward routes to the TargNode that also satisfy the OF, and the Destination Sequence Number is at least as large as the Sequence Number in the RREQ-DIO message 🧐. After unicasting the G-RREP to the OrigNode, the intermediate router then unicasts the RREQ towards TargNode. That way, TargNode gets the advertised route towards OrigNode along with the RREQ-InstanceID for the RREQ-Instance 🫶. An upstream intermediate router that receives such a G-RREP MUST also generate a G-RREP and send it further upstream towards OrigNode.
For source routing, the intermediate router MUST include the Address Vector between the OrigNode and itself in the G-RREP. It also includes the Address Vector in the unicast RREQ-DIO towards TargNode. When TargNode gets the unicast RREQ-DIO, it has a route Address Vector from itself to the OrigNode. Then the router MUST include the Address Vector from TargNode to the router itself in the G-RREP-DIO it sends 🗺️.
For hop-by-hop routes, the intermediate router MUST unicast the received RREQ-DIO to the Next Hop on the route. The Next Hop router along the route MUST build new route entries with the related RPLInstanceID and DODAGID in the downward direction. This repeats at each node until the RREQ-DIO reaches TargNode. Then TargNode, and each router along the path towards OrigNode, MUST unicast the RREP-DIO hop-by-hop towards OrigNode as specified in Section 6.3 ✨.
8. Operation of Trickle Timer ⏰
RREQ-Instance/RREP-Instance multicast uses Trickle timer operations [RFC6206] to control RREQ-DIO and RREP-DIO transmissions. The Trickle control of these DIO transmissions follows the procedures in Section 8.3 of [RFC6550], which is called "DIO Transmission". If the route is symmetric, the RREP-DIO doesn't need the Trickle timer mechanism 🙌.
9. IANA Considerations 📋
AODV-RPL uses the "P2P Route Discovery Mode of Operation" (MOP == 4), along with the new options in this document. This document has been added as an additional reference for "P2P Route Discovery Mode of Operation" in the "Mode of Operation" registry, which lives in the "Routing Protocol for Low Power and Lossy Networks (RPL)" registry group 🗂️.
IANA has assigned the three new AODV-RPL options described in Table 1 in the "RPL Control Message Options" registry, which is also in the "Routing Protocol for Low Power and Lossy Networks (RPL)" registry group 🎀.
+=======+=========+===========+
| Value | Meaning | Reference |
+=======+=========+===========+
| 0x0B | RREQ | RFC 9854 |
+-------+---------+-----------+
| 0x0C | RREP | RFC 9854 |
+-------+---------+-----------+
| 0x0D | ART | RFC 9854 |
+-------+---------+-----------+
Table 1: AODV-RPL OptionsIANA has also allocated the permanent multicast address with link-local scope in Table 2 for nodes implementing this specification. That allocation was made in the "Local Network Control Block (224.0.0.0 - 224.0.0.255 (224.0.0/24))" registry, which is inside the "IPv4 Multicast Address Space Registry" registry group 📡.
+=============+====================+============+
| Address(es) | Description | References |
+=============+====================+============+
| 224.0.0.69 | all-AODV-RPL-nodes | RFC 9854 |
+-------------+--------------------+------------+
Table 2: Permanent Multicast Address with
Link-Local Scope10. Security Considerations 🔐
Okay, this part is serious, bestie 😭. The security considerations for AODV-RPL are pretty similar to the ones for RPL (see Section 19 of the RPL specification [RFC6550]). Sections 6.1 and 10 of [RFC6550] describe RPL's optional security framework, which AODV-RPL relies on to provide data confidentiality, authentication, replay protection, and delay protection services. More analysis of the security threats to RPL can be found in [RFC7416] 🕵️♀️.
A router can join a temporary DAG created for a secure AODV-RPL route discovery only if it can support the security configuration in use (see Section 6.1 of [RFC6550]), which also specifies the key in use. It doesn't matter whether the key is preinstalled or dynamically acquired. The router must have the key in use before it can join the DAG being created for secure route discovery 🔑.
If a rogue router knows the key for the security configuration in use, it can join the secure AODV-RPL route discovery and cause all sorts of damage 💀. That rogue router could advertise false information in its DIOs to get itself into the discovered route(s). It could generate bogus RREQ-DIO and RREP-DIO messages carrying bad routes, or maliciously modify genuine RREP-DIO messages it receives. A rogue router acting as the OrigNode could launch denial-of-service attacks against the LLN deployment by starting fake AODV-RPL route discoveries. When rogue routers might be present, RPL's preinstalled mode of operation, where the key to use for route discovery is preinstalled, SHOULD be used 🛡️.
When an RREQ-DIO message uses the source routing option by setting the H bit to 0, a rogue router may populate the Address Vector field with a set of addresses that may cause the RREP-DIO to travel in a routing loop 🌀.
If a rogue router is able to forge a G-RREP, it could mount denial-of-service attacks 😱.
11. References 📚
11.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<https://www.rfc-editor.org/info/rfc2119>.
[RFC6206] Levis, P., Clausen, T., Hui, J., Gnawali, O., and J. Ko,
"The Trickle Algorithm", RFC 6206, DOI 10.17487/RFC6206,
March 2011, <https://www.rfc-editor.org/info/rfc6206>.
[RFC6550] Winter, T., Ed., Thubert, P., Ed., Brandt, A., Hui, J.,
Kelsey, R., Levis, P., Pister, K., Struik, R., Vasseur,
JP., and R. Alexander, "RPL: IPv6 Routing Protocol for
Low-Power and Lossy Networks", RFC 6550,
DOI 10.17487/RFC6550, March 2012,
<https://www.rfc-editor.org/info/rfc6550>.
[RFC6551] Vasseur, JP., Ed., Kim, M., Ed., Pister, K., Dejean, N.,
and D. Barthel, "Routing Metrics Used for Path Calculation
in Low-Power and Lossy Networks", RFC 6551,
DOI 10.17487/RFC6551, March 2012,
<https://www.rfc-editor.org/info/rfc6551>.
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
May 2017, <https://www.rfc-editor.org/info/rfc8174>.11.2. Informative References ✨
okay bestie, here are all the receipts for the sources this part leans on 🧾📚💖
- [aodv-tot] Perkins, C.E. and E.M. Royer, "Ad-hoc On-demand Distance Vector Routing", Proceedings WMCSA'99. Second IEEE Workshop on Mobile Computing Systems and Applications, pp. 90-100, DOI 10.1109/MCSA.1999.749281, February 1999,
<https://ieeexplore.ieee.org/document/749281>. - [co-ioam] Ballamajalu, R., Anand, S.V.R., and M. Hegde, "Co-iOAM: In-situ Telemetry Metadata Transport for Resource Constrained Networks within IETF Standards Framework", 2018 10th International Conference on Communication Systems & Networks (COMSNETS), pp. 573-576, DOI 10.1109/COMSNETS.2018.8328276, January 2018,
<https://ieeexplore.ieee.org/document/8328276>. - [contiki] "The Contiki Open Source OS for the Internet of Things (Contiki Version 2.7)", commit 7635906, November 2013,
<https://github.com/contiki-os/contiki>. - [Contiki-ng] "Contiki-NG: The OS for Next Generation IoT Devices (Contiki-NG Version 4.6)", commit 3b0bc6a, December 2020,
<https://github.com/contiki-ng/contiki-ng>. - [cooja] "Cooja Simulator for Wireless Sensor Networks (Contiki/Cooja Version 2.7)", commit 7635906, November 2013,
<https://github.com/contiki-os/contiki/tree/master/tools/cooja>. - [empirical-study] Misra, P., Ahmed, N., and S. Jha, "An empirical study of asymmetry in low-power wireless links", IEEE Communications Magazine, vol. 50, no. 7, pp. 137-146, DOI 10.1109/MCOM.2012.6231290, July 2012,
<https://ieeexplore.ieee.org/document/6231290>. - [Link_Asymmetry] Sang, L., Arora, A., and H. Zhang, "On Link Asymmetry and One-way Estimation in Wireless Sensor Networks", ACM Transactions on Sensor Networks, vol. 6, no. 2, pp. 1-25, DOI 10.1145/1689239.1689242, March 2010,
<https://doi.org/10.1145/1689239.1689242>. - [low-power-wireless] Srinivasan, K., Dutta, P., Tavakoli, A., and P. Levis, "An empirical study of low-power wireless", ACM Transactions on Sensor Networks, vol. 6, no. 2, pp. 1-49, DOI 10.1145/1689239.1689246, March 2010,
<https://doi.org/10.1145/1689239.1689246>. - [RFC3561] Perkins, C., Belding-Royer, E., and S. Das, "Ad hoc On-Demand Distance Vector (AODV) Routing", RFC 3561, DOI 10.17487/RFC3561, July 2003,
<https://www.rfc-editor.org/info/rfc3561>. - [RFC6687] Tripathi, J., Ed., de Oliveira, J., Ed., and JP. Vasseur, Ed., "Performance Evaluation of the Routing Protocol for Low-Power and Lossy Networks (RPL)", RFC 6687, DOI 10.17487/RFC6687, October 2012,
<https://www.rfc-editor.org/info/rfc6687>. - [RFC6997] Goyal, M., Ed., Baccelli, E., Philipp, M., Brandt, A., and J. Martocci, "Reactive Discovery of Point-to-Point Routes in Low-Power and Lossy Networks", RFC 6997, DOI 10.17487/RFC6997, August 2013,
<https://www.rfc-editor.org/info/rfc6997>. - [RFC6998] Goyal, M., Ed., Baccelli, E., Brandt, A., and J. Martocci, "A Mechanism to Measure the Routing Metrics along a Point-to-Point Route in a Low-Power and Lossy Network", RFC 6998, DOI 10.17487/RFC6998, August 2013,
<https://www.rfc-editor.org/info/rfc6998>. - [RFC7276] Mizrahi, T., Sprecher, N., Bellagamba, E., and Y. Weingarten, "An Overview of Operations, Administration, and Maintenance (OAM) Tools", RFC 7276, DOI 10.17487/RFC7276, June 2014,
<https://www.rfc-editor.org/info/rfc7276>. - [RFC7416] Tsao, T., Alexander, R., Dohler, M., Daza, V., Lozano, A., and M. Richardson, Ed., "A Security Threat Analysis for the Routing Protocol for Low-Power and Lossy Networks (RPLs)", RFC 7416, DOI 10.17487/RFC7416, January 2015,
<https://www.rfc-editor.org/info/rfc7416>. - [RFC7548] Ersue, M., Ed., Romascanu, D., Schoenwaelder, J., and A. Sehgal, "Management of Networks with Constrained Devices: Use Cases", RFC 7548, DOI 10.17487/RFC7548, May 2015,
<https://www.rfc-editor.org/info/rfc7548>. - [RFC9010] Thubert, P., Ed. and M. Richardson, "Routing for RPL (Routing Protocol for Low-Power and Lossy Networks) Leaves", RFC 9010, DOI 10.17487/RFC9010, April 2021,
<https://www.rfc-editor.org/info/rfc9010>. - [RFC9030] Thubert, P., Ed., "An Architecture for IPv6 over the Time-Slotted Channel Hopping Mode of IEEE 802.15.4 (6TiSCH)", RFC 9030, DOI 10.17487/RFC9030, May 2021,
<https://www.rfc-editor.org/info/rfc9030>.
Appendix A. Example: Using ETX/RSSI Values to Determine Value of S Bit 🦋
okay so the combo of the downstream Received Signal Strength Indicator (RSSI) and the upstream Expected Transmission Count (ETX) has actually been tested to figure out whether a link is symmetric or asymmetric at intermediate routers 💅. We present two methods to get an ETX value out of an RSSI measurement.
Method 1: the first method is giving science experiment 🧪. They built a table measuring RSSI versus ETX using the Cooja simulation [cooja] setup in the Contiki OS environment [contiki]. They ran Contiki-2.7 with the 6LoWPAN/RPL protocol stack for the simulations. To approximate how many packets get dropped based on RSSI, they wrote simple logic that drops transmitted packets at certain predefined ratios before handing them over to the receiver. The packet drop ratio is a table lookup of RSSI ranges mapping to different packet drop ratios, with lower RSSI ranges resulting in higher values. While this table was defined to capture the overall link behavior, in general, it is highly recommended to conduct physical radio measurement experiments 🙈. By keeping the receiving node at different distances, they let the packets experience different drops as per the described method. The ETX value computation is done by another module that is part of the RPL OF implementation. Since the ETX value reflects the extent of packet drops, it allowed them to prepare a useful table correlating ETX and RSSI values (see Table 3). ETX and RSSI values obtained in this way may be used as explained below:
Source -------> NodeA -------> NodeB -----> Destination
Figure 6: Communication Link from Source to Destination +=========================+=======================+
| RSSI at NodeA for NodeB | Expected ETX at NodeA |
| | for NodeB->NodeA |
+=========================+=======================+
| > -60 | 150 |
+-------------------------+-----------------------+
| -70 to -60 | 192 |
+-------------------------+-----------------------+
| -80 to -70 | 226 |
+-------------------------+-----------------------+
| -90 to -80 | 662 |
+-------------------------+-----------------------+
| -100 to -90 | 3840 |
+-------------------------+-----------------------+
Table 3: Selection of S Bit Based on Expected
ETX ValueMethod 2: one could also make use of the function guess_etx_from_rssi() defined in the 6LoWPAN/RPL protocol stack of Contiki-ng OS [Contiki-ng] to get the RSSI-ETX mapping 🌸. This function outputs an ETX value ranging between 128 and 3840 for -60 <= rssi <= -89. The function description is beyond the scope of this document.
We tested the operations in this specification by running the following experiment, using the above parameters 🔬. In our experiment, a communication link is considered symmetric if the ETX value of NodeA->NodeB and NodeB->NodeA (see Figure 6) are within, say, a 1:3 ratio. This ratio should be understood as determining the link's symmetric/asymmetric nature. NodeA can typically know the ETX value in the direction of NodeA->NodeB, but it has no direct way of knowing the value of ETX from NodeB->NodeA. Using physical testbed experiments and realistic wireless channel propagation models, one can determine a relationship between RSSI and ETX that is representable as an expression or a mapping table. Such a relationship, in turn, can be used to estimate the ETX value at NodeA for link NodeB->NodeA from the received RSSI from NodeB. Whenever NodeA determines that the link towards the NodeB is bidirectional asymmetric, then the S bit is set to 0. Afterwards, the link from NodeA to Destination remains designated as asymmetric, and the S bit remains set to 0 🫶.
Determination of asymmetry versus bidirectionality remains a topic of lively discussion in the IETF 🍓.
Appendix B. Some Example AODV-RPL Message Flows 🧚
This appendix provides some example message flows showing RREQ and RREP establishing symmetric and asymmetric routes ✨. Also, examples for the use of RREP_WAIT and G-RREP are included. In the examples, router (O) is to be understood as performing the role of OrigNode. Router (T) is to be understood as performing the role of TargNode. Routers (R) are intermediate routers that are performing AODV-RPL functions in order to discover one or more suitable routes between (O) and (T) 🌈.
B.1. Example Control Message Flows in Symmetric and Asymmetric Networks ✨
okay so this is where it gets visual 🦋 RREQ messages get multicast out from router (O) to find routes to and from router (T). The RREQ control messages flow outward from (O), and each router along the way sets up a single RREQ-Instance identified by RREQ-InstanceID. That's true even if multiple RREQs show up with the same RREQ-InstanceID 🫶
In the top half of the diagram, every router can offer a symmetric route at each hop from (O) to (T). So when (T) gets an RREQ, it can already send data packets back to (O). Then (T) gets ready to send an RREP along that symmetric path, so (O) can send packets to (T). main character energy 💅
(R) ---RREQ(S=1)--->(R) ---RREQ(S=1)--->(R)
^ |
| |
RREQ(S=1) RREQ(S=1)
| |
| v
(O) --------->(R) --------->(R)-------->(T)
/ \ RREQ RREQ RREQ ^
| \ (S=1) (S=0) (S=0) |
| \ /
RREQ | \ RREQ (S=1) RREQ (S=0)
(S=0) | \ /
v \ RREQ (S=0) /
(R) ---->(R)------>(R)----.....--->(R)
Figure 7: AODV-RPL RREQ Message Flow Example When Symmetric Path
AvailableNext up is the diagram that comes out of that RREQ transmission. Now there's a symmetric route from (T) back to router (O) through the routers in the top half 🌸 RREP messages get unicast along that symmetric route. Since the RREP is unicast, (T) doesn't send any RREP messages to the routers in the bottom half. no extra messages, just vibes 🧚
(R)<------RREP----- (R)<------RREP----- (R)
| ^
| |
RREP RREP
| |
v |
(O) ----------(R) ----------(R) --------(T)
/ \ |
| \ |
| \ (no RREP messages sent) /
| \ /
| \ /
| \ /
(R) -----(R)-------(R)----.....----(R)
Figure 8: AODV-RPL RREP Message Flow Example When Symmetric Path
AvailableNow let's look at a sad little scenario where there's no symmetric route from (O) to (T) 🥺 Same deal, RREQ messages get multicast out from router (O) to find routes to and from router (T), but this time the diagram shows that no symmetric route exists from (O) to (T).
(R) ---RREQ(S=0)--->(R) ---RREQ(S=0)--->(R)
^ |
| |
RREQ(S=1) RREQ(S=0)
| |
| v
(O) --------->(R) --------->(R)-------->(T)
^ \ RREQ RREQ RREQ | \
| \ (S=1) (S=0) (S=0) | |
| \ / |
| RREQ (S=1) RREQ (S=0) / (R)
| \ / |
| \ RREQ (S=0) / /
(R) ---->(R)------>(R)----.....----->(R)---
Figure 9: AODV-RPL RREQ Message Flow When Symmetric Path UnavailableSo after receiving the RREQ in Figure 9, router (T) gets ready to send an RREP that lets router (O) send packets to router (T) 💜 Since there's no symmetric route from (T) back to router (O) here, the RREP messages get sent by multicast to all neighboring routers, which is a totally different vibe from the unicast in Figure 8.
(R)<------RREP----- (R)<------RREP----- (R)
| |
| |
RREP RREP
| |
| |
v v
(O)<--------- (R)<--------- (R)<------- (T)
^ \ RREP RREP RREP | \
| \ | |RREP
| \ / |
RREP | \ RREP RREP / (R)
| \ / |
| \ / /
(R)<----- (R)<----- (R)<---.....---- (R)< - RREP
RREP RREP RREP
Figure 10: AODV-RPL RREQ and RREP-Instances for Asymmetric LinksB.2. Example RREP_WAIT Handling 🎀
Let's walk through RREP_WAIT. In Figure 11, the first RREQ shows up at (T). That kicks off TargNode's RREP_WAIT_TIME timer ⏰
(O) --------->(R) --------->(R)-------->(T)
RREQ RREQ RREQ
(S=1) (S=0) (S=0)
Figure 11: TargNode Starts RREP_WAITIn Figure 12, another RREQ arrives before the RREP_WAIT_TIME timer expires 👀 This new one could be a better pick than the RREP that started the timer in the first place.
(O) (T)
/ \ ^
| \ |
| \ /
RREQ | \ RREQ (S=1) RREQ (S=0)
(S=0) | \ /
v \ RREQ (S=0) /
(R) ---->(R)------>(R)----.....--->(R)
Figure 12: Waiting TargNode Receives Preferable RREQIn Figure 13, the RREP_WAIT_TIME timer runs out and TargNode picks the path with S=1 🏁
(R) ---RREQ(S=1)--->(R) ---RREQ(S=1)--->(R)
^ |
| |
RREQ(S=1) RREQ(S=1)
| |
| v
(O) (T)
Figure 13: RREP_WAIT Expires at TargNodeB.3. Example G-RREP Handling 🦄
In Figure 14, R* has upward and downward routes to TargNode (T). Those routes satisfy the OF of the RPL Instance originated by OrigNode (O), and the Destination Sequence Number is at least as large as the Sequence Number in the RREQ message 🧠
(R) ---RREQ(S=1)--->(R) ---RREQ(S=0)--->(R)
^ |
| |
RREQ(S=1) RREQ(S=0)
| |
| v
(O) --------->(R) --------->(R)-------->(T)
/ \ RREQ RREQ RREQ ^
| \ (S=1) (S=0) (S=0) |
| \ /
RREQ | \ RREQ (S=1) /
(S=0) | \ /
v \ v
(R) ---->(R*)<------>(R)<----....--->(R)
Figure 14: RREP Triggers G-RREP at Intermediate NodeIn Figure 15, R* sends the G-RREP-DIO back to OrigNode (O) and forwards the incoming RREQ toward (T) 🚀
(O) (T)
\ ^
\ |
\ (RREQ) /
\ G-RREP-DIO /
\ /
\ (RREQ) (RREQ) /
(R*)------>(R)----....--->(R)
Figure 15: Intermediate Node Initiates G-RREPAcknowledgements 🫶
The authors thank Pascal Thubert, Rahul Jadhav, and Lijo Thomas for their support and valuable input 💖 They specially thank Lavanya H.M. for implementing AODV-RPL in Contiki and conducting extensive simulation studies 👑
The authors would like to acknowledge the reviews, feedback, and comments from the following people, in alphabetical order: Roman Danyliw, Lars Eggert, Benjamin Kaduk, Tero Kivinen, Erik Kline, Murray Kucherawy, Warren Kumari, Francesca Palombini, Alvaro Retana, Ines Robles, John Scudder, Meral Shirazipour, Peter Van der Stok, Éric Vyncke, and Robert Wilton ✨ the whole squad showed up 😭
Contributors 🌈
Abdur Rashid Sangi
Wenzhou-Kean University
88 Daxue Rd, Ouhai
Wenzhou
Zhejiang Province, 325060
Kean University
1000 Morris Avenue
Union, New Jersey 07083
United States of America
China
Email: sangi_bahrian@yahoo.comMalati Hegde
Indian Institute of Science
Bangalore 560012
India
Email: malati@iisc.ac.inMingui Zhang
Huawei Technologies
No. 156 Beiqing Rd.
Haidian District
Beijing
100095
China
Email: zhangmingui@huawei.comAuthors' Addresses 🌸
Charles E. Perkins
Blue Meadow Networks
Saratoga, CA 95070
United States of America
Email: charliep@lupinlodge.comS.V.R. Anand
Indian Institute of Science
Bangalore 560012
India
Email: anandsvr@iisc.ac.inSatish Anamalamudi
SRM University-AP
Amaravati Campus
Amaravati, Andhra Pradesh 522 502
India
Email: satishnaidu80@gmail.comBing Liu
Huawei Technologies
No. 156 Beiqing Rd.
Haidian District
Beijing
100095
China
Email: remy.liubing@huawei.com📦 where this page comes from
- ietf: rfc9854 2025-10
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms