RFC 9866

Root Node Failure Detector (RNFD): Fast Detection of Border Router Crashes in the Routing Protocol for Low-Power and Lossy Networks (RPL)

📅 published October 2025, from ietf

Root Node Failure Detector (RNFD): Fast Detection of Border Router Crashes in the Routing Protocol for Low-Power and Lossy Networks (RPL) 💖

okay bestie, let's get into this one 🎀 It's RFC 9866, written by K. Iwanicki from the University of Warsaw, and it's a Standards Track document (so it's an actual official spec, not just a vibe-check 💅). It was published in October 2025, and it's officially listed under ISSN 2070-1721. ✨

The title block doesn't say it obsoletes or updates anything, so this is a brand new extension, not a replacement for an older RFC. 🌸

Abstract ✨

okay so the big picture is this: a network running RPL (the IPv6 routing protocol for Low-Power and Lossy Networks) basically needs its border routers to be up. like, if they go down, everything gets messy 😭. The fix this doc proposes is called the Root Node Failure Detector (RNFD), and it's an extension to RPL that helps nodes spot a border router crash super fast by teaming up and watching the router together 🫶. To make that work, it adds a little extra state at each node, a brand new type of RPL Control Message Option to keep that state in sync across nodes, and the actual coordination algorithm. it's giving teamwork 👑

Status of This Memo 🎀

This is an Internet Standards Track document. 🌈

This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community, received public review, and got approved for publication by the Internet Engineering Steering Group (IESG). If you want more info on Internet Standards, check out Section 2 of RFC 7841. 💅

You can find the current status, any errata, and a way to send feedback at https://www.rfc-editor.org/info/rfc9866. 🦋

Copyright (c) 2025 IETF Trust and the persons identified as the document authors. All rights reserved. 🔥

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication. Please read these carefully, because they spell out your rights and restrictions for this document. Code Components pulled out of this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come without warranty as described in that license. 🙈

Table of Contents 🧚

  1. Introduction 1.1. Effects of LBR Crashes 1.2. Design Principles 1.3. Other Solutions
  2. Terminology
  3. Overview 3.1. Protocol State Machine 3.2. Counters and Communication
  4. The RNFD Option 4.1. General CFRC Requirements 4.2. Format of the Option
  5. RPL Router Behavior 5.1. Joining a DODAG Version and Changing the RNFD Role 5.2. Detecting and Verifying Problems with the DODAG Root 5.3. Disseminating Observations and Reaching Agreement 5.4. DODAG Root's Behavior 5.5. Activating and Deactivating the Protocol on Demand 5.6. Processing CFRCs of Incompatible Lengths 5.7. Summary of RNFD's Interactions with RPL 5.8. Summary of RNFD's Constants
  6. Manageability Considerations 6.1. Role Assignment and CFRC Size Adjustment 6.2. Virtual DODAG Roots 6.3. Monitoring
  7. Security Considerations
  8. IANA Considerations
  9. References 9.1. Normative References 9.2. Informative References Acknowledgements Author's Address

1. Introduction 🌸

1.1. Effects of LBR Crashes 💀

okay so RPL is an IPv6 routing protocol made for Low-Power and Lossy Networks (LLNs) [RFC6550]. These networks are usually low on device energy and channel capacity 🥺. They're mostly made of nodes with barely any processing power or memory, and links that are wildly inconsistent and only handle low data rates. So a huge challenge for an LLN routing protocol is cutting down on resource use without being slow to react to network changes. it's a whole balancing act 🤹‍♀️

One of RPL's main design choices, to keep nodes lightweight, is handing most of the routing responsibility over to LLN Border Routers (LBRs) 👑. The network gets organized into Destination-Oriented Directed Acyclic Graphs (DODAGs), where each one is tied to an LBR, and every path ends at that LBR. Every node gets a dynamically assigned Rank, which is basically its distance from a given LBR, measured in some metric. The LBR has the lowest Rank, since it's the DODAG root. Ranks let each non-LBR node pick its neighbors (the nodes it has links to) that are closer to the LBR than it is. Those are its parents in the graph. 🦋 The DODAG paths made of these node-parent links are used for routing packets upward to the LBR and outside the LLN. Nodes also use them to report their connectivity upward, which lets packets head back down from the LBR to them (for example, with source routing [RFC6554]). So LBRs aren't just routing, they're also driving how the DODAG gets built and maintained. they're the main character of the whole protocol, honestly ✨

Since LBRs play such a central role, they're expected to be stronger than regular LLN nodes. They're assumed not to be limited in computing power, memory, or energy, which usually means a more complicated hardware-software setup and a wired power supply 🔌. But that also makes them more likely to fail, especially because it's often hard to give every LBR a backup power supply in big deployments 😩.

1.1. Effects of LBR Crashes 💀

Here's the tea. When an LBR crashes (or, more generally, fails in a way that stops the other nodes in its DODAG from talking to it), the nodes also lose the ability to reach other Internet hosts. On top of that, a big chunk of the DODAG paths between nodes become invalid, because they run through the dead LBR. The rest also fall apart from DODAG repair attempts, which are doomed to fail. So routing inside the DODAG basically becomes impossible too 💔. That's why it's really desirable for nodes to detect an LBR crash fast, so they can leave the broken DODAG and join another one, or trigger extra application- or deployment-specific fallback mechanisms. That keeps the damage from the disconnection as small as possible 🩹.

Since every DODAG path leads to the corresponding LBR, when a node detects its crash, it has to drop all its parents and adopt an infinite Rank, which shows it can't reach the dead LBR. Depending on the deployment, the node can stay in that state, join a different DODAG, or even become the root of a floating DODAG. Either way, getting all nodes into this state is slow, can generate heavy traffic, and is hard to implement correctly [Iwanicki16] [Paszkowska19] [Ciolkosz19]. not it being this hard 😭

Let's break down why. First, tearing down all DODAG paths needs each of the dead LBR's neighbors to notice that its link to the LBR isn't up anymore. Otherwise, any neighbor that doesn't know this can keep advertising a finite Rank, and other nodes might pick it as their parent or ancestor. Those nodes will wrongly think they still have a valid path to the dead LBR 🙃. A node usually detects a link crash only after it has seen enough forwarding failures over that link. So, given LLNs run low-data-rate applications, the time from the crash until the last link to the dead LBR is removed from the DODAG can be long ⏳. Then, learning that none of their links can form a path to the dead LBR adds more latency for all nodes. Part of that is because nodes keep changing parents on their own, trying to fix their broken paths locally. Since a non-LBR node only knows its local part of the network (which might not match what other nodes know), those parent changes often create paths with loops. Those loops have to be broken before everyone can agree that no path to the dead LBR exists globally 🌀. Even with RPL's dedicated loop detection mechanisms [RFC6553], this costs traffic and therefore time. Finally, switching a parent or finding a loop can also set off bursts of control traffic, because of the adaptive Trickle algorithm used to exchange DODAG information [RFC6206] 📣. Overall, how the network handles an LBR crash is really suboptimal, which doesn't fit RPL's goals of minimizing resource consumption and reaction latency 😤.

1.2. Design Principles 🎀

To tackle this, the document proposes an extension to RPL called the "Root Node Failure Detector (RNFD)". To cut down the time and traffic needed to handle an LBR crash, RNFD follows these design principles, which come straight from the observations above:

  1. Explicitly coordinate LBR monitoring between nodes, instead of only relying on the emergent behavior that comes from them operating independently. 🤝
  2. Avoid probing all links to the dead LBR, so the tail latency of removing those links from the DODAG goes down. 🏃‍♀️
  3. Exploit concurrency by prompting proactive checks for a possible LBR crash when some nodes suspect one may have happened, which aims to cut the overall latency even more. ⚡
  4. Minimize changes to RPL's existing algorithms by running in parallel and largely independently (in the background), and by adding only a few extra assumptions. 🧩

These principles really do improve RPL's performance across a wide range of LBR crashes, but because they're probabilistic, they can't promise hard guarantees for every possible corner case 🎲. Specifically, in some scenarios RNFD may produce false negatives. Those situations are weird, though, and RPL's own mechanisms I mentioned earlier will eventually handle them. Likewise, in some scenarios, especially ones with highly unstable links, false positives may happen, but those can be eased too 🌊. Either way, the principles also guarantee that RNFD can be deactivated at any time if needed, and when that happens, RPL's operation is unaffected 🫶.

1.3. Other Solutions 🌈

Given how bad LBR failures can be, it's also worth looking at other solutions. Power outages can be eased by setting up redundant power sources or emergency batteries 🔋. RPL's so-called virtual DODAG roots can also help tolerate some failures of individual LBRs 💖.

As mentioned before, RNFD was designed to stay largely independent of those solutions. So rather than trying to replace them, RNFD can complement them 🤗. The way RNFD works with different variants of virtual DODAG roots is covered in Section 6.2 ✨.

Part 1 of 6 done, bestie 🦋 Part 2 is coming up next, so stay tuned 💅💖

2. Terminology ✨

Okay bestie, this part is where we get our vocab locked in 🔐 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here. So the capitals are doing real work here, no cap 💅

The terminology here is consistent with and builds on "Terms Used in Routing for Low-Power and Lossy Networks" [RFC7102], "RPL: IPv6 Routing Protocol for Low-Power and Lossy Networks" [RFC6550], and "The Routing Protocol for Low-Power and Lossy Networks (RPL) Option for Carrying RPL Information in Data-Plane Datagrams" [RFC6553]. Other terms used in LLNs can be found in "Terminology for Constrained-Node Networks" [RFC7228] 🧚

Here are the acronyms that show up in the document 🎀

  • DIO: DODAG Information Object (a RPL message)
  • DIS: DODAG Information Solicitation (a RPL message)
  • DODAG: Destination-Oriented Directed Acyclic Graph
  • LLN: Low-Power and Lossy Network
  • LBR: LLN Border Router

The document also introduces some brand new concepts 🦋

  • Sentinel: One of the two roles that a node can play in RNFD. For a given DODAG Version, a Sentinel node is a DODAG root's neighbor that monitors the DODAG root's status. There are normally multiple Sentinels for a DODAG root. However, being the DODAG root's neighbor need not imply being a Sentinel. Not every neighbor is automatically a Sentinel, bestie, so don't assume 🙈
  • Acceptor: The other of the two roles that a node can play in RNFD. For a given DODAG Version, an Acceptor node is a node that is not a Sentinel. So basically, if you're not a Sentinel, you're an Acceptor 🌸
  • Locally Observed DODAG Root's State (LORS): A node's local knowledge of the DODAG root's status, specifying in particular whether the DODAG root is up. This is the node's own personal read on whether the root is alive 👀
  • Conflict-Free Replicated Counter (CFRC): Conceptually represents a dynamic set whose cardinality can be estimated. It defines a partial order on its values and supports element addition and union. The union operation is order- and duplicate-insensitive, that is, idempotent, commutative, and associative. This one is the big brain concept, and we'll see it everywhere 🧠✨

3. Overview 🌈

As mentioned previously, LBRs are DODAG roots in RPL. Hence, a crash of an LBR is global in that it affects all nodes in the corresponding DODAG. Like, one LBR goes down and the whole DODAG feels it 😭 So each node running RNFD for a given DODAG explicitly tracks the DODAG root's current condition, which is referred to as Locally Observed DODAG Root's State (LORS), and synchronizes its local knowledge with other nodes. Everyone's getting on the same page, periodt 💖

Monitoring the condition of the DODAG root is done by tracking the status of its links (i.e., whether they are up or down). That means it can only be done by the root's neighbors, so other nodes must accept their observations. Depending on their roles, non-root nodes are divided in RNFD into two disjoint groups: Sentinels and Acceptors. A Sentinel node is a DODAG root's neighbor that monitors its link with the root. So the DODAG root normally has multiple Sentinels, but being its neighbor need not imply being a Sentinel. An Acceptor node is a node that is not a Sentinel. Acceptors mainly collect and propagate the Sentinels' observations, so they're the ones spreading the tea 🫖 More information on Sentinel selection can be found in Section 6.1.

3.1. Protocol State Machine 🔥

The possible values of LORS and the transitions between them are depicted in Figure 1. The states "UP" and "GLOBALLY DOWN" can be attained by both Sentinels and Acceptors. The states "SUSPECTED DOWN" and "LOCALLY DOWN" can be attained by Sentinels only, so Acceptors skip that drama 💅

  +---------------------------------------------------------+
  |                      |---------------------------+   3a |
  |    +-----------------+---------+              3b |      |
  |    | 2b              |         v                 v      v
+-+----+-+   1 +---------+-+     +-----------+     +-+------+-+
|   UP   +---->+ SUSPECTED +---->+  LOCALLY  +---->+ GLOBALLY |
|        +<----+    DOWN   | 2a  |    DOWN   | 3c  |   DOWN   |
+-+----+-+  4a +-----------+     +-+---------+     +-+--------+
  ^    ^                           |                 |
  |    |                        4b |                 |
  |    +---------------------------+               5 |
  +--------------------------------------------------+

Figure 1: RNFD States and Transitions

Okay so, when any node joins a DODAG Version, the DODAG root must appear alive. That's why the node starts RNFD with its LORS equal to "UP". For a properly working DODAG root, the node just stays in state "UP", easy breezy 🌞

Now, when a node acting as a Sentinel starts suspecting that the root may have crashed, it changes its LORS to "SUSPECTED DOWN" (transition 1 in Figure 1). The move from "UP" to "SUSPECTED DOWN" can happen based on the node's observations at either the data plane (e.g., link-layer triggers about missing hop-by-hop acknowledgments for packets forwarded over the node's link to the root) or the control plane (e.g., a significant growth in the number of Sentinels already suspecting the root to be dead). In state "SUSPECTED DOWN", the Sentinel node may verify its suspicion and/or inform other nodes about the suspicion. Once that's done, it changes its LORS to "LOCALLY DOWN" (transition 2a). In some cases, the verification need not be performed. As an optimization, a direct transition from "UP" to "LOCALLY DOWN" (transition 2b) can be done instead, which is lowkey a shortcut ⚡

If a sufficient number of Sentinels have their LORS equal to "LOCALLY DOWN", then all nodes (Sentinels and Acceptors) consent globally that the DODAG root must have crashed. They all set their LORS to "GLOBALLY DOWN", irrespective of the previous value (transitions 3a, 3b, and 3c). This is the big moment, the whole group agrees 🫶 State "GLOBALLY DOWN" is terminal, meaning the only transition any node can perform from it to another state (transition 5) happens when the node joins a new DODAG Version. Once a node is in state "GLOBALLY DOWN", RNFD forces RPL to maintain an infinite Rank and no parent, which stops routing packets upward in the DODAG. In other words, this state means all non-root nodes agree that the current DODAG Version is unusable. So to recover, the root has to give a proof of being alive by initiating a new DODAG Version. It's giving "prove you're alive, bestie" 💀

In contrast, if a node (either a Sentinel or Acceptor) is in state "UP", RNFD does not influence RPL's packet forwarding. A node can route packets upward if it has a parent. The same is true for states "SUSPECTED DOWN" and "LOCALLY DOWN", which are attainable only by Sentinels. Finally, while in any of those two states, a Sentinel node may observe some activity of the DODAG root and hence decide that its suspicion was a mistake. In that case, it returns to state "UP" (transitions 4a and 4b). Oops, false alarm, we all make mistakes 🌷

3.2. Counters and Communication 🎀

To enable arriving at a global conclusion that the DODAG root has crashed (i.e., transitioning to state "GLOBALLY DOWN"), all nodes count locally and synchronize among each other the number of Sentinels considering the root to be dead (i.e., those in state "LOCALLY DOWN"). This process employs structures referred to as Conflict-Free Replicated Counters (CFRCs). They are stored and modified independently by each node, and they are disseminated throughout the network in options added to RPL link-local control messages: DODAG Information Objects (DIOs) and DODAG Information Solicitations (DISs). When a node receives such an option from its neighbor, it merges the received counter with its local one, which gives it a new content for its local counter. Merge, merge, merge 🔄

The merging operation is idempotent, commutative, and associative. Moreover, all possible counter values are partially ordered. This enables ensuring eventual consistency of the counters across all nodes, irrespective of the particular sequence of merges, shape of the DODAG, or general network topology. Honestly the math is so clean 🤌 In effect, as long as the network is connected, all nodes will be able to arrive at the same conclusion regarding the DODAG root, especially when no two Sentinels have a direct link with each other.

Each node in RNFD maintains two CFRCs for a DODAG:

  • PositiveCFRC: Counts Sentinels that consider or have previously considered the root node as alive in the current DODAG Version.
  • NegativeCFRC: Counts Sentinels that consider or have previously considered the root node as dead in the current DODAG Version.

The PositiveCFRC is always greater than or equal to the NegativeCFRC in terms of the partial order defined for the counters. The difference between the value of the PositiveCFRC and the value of the NegativeCFRC is thus nonnegative, and it estimates the number of Sentinels that still consider the DODAG root node as alive. So you can literally do the subtraction to see how many Sentinels are still team "root is alive" 📊✨

4. The RNFD Option 🦋

RNFD state synchronization between nodes takes place through the RNFD Option. It is a new type of RPL Control Message Option that is carried in link-local RPL control messages, notably DIOs and DISs. Its main job is allowing the receivers to merge their two CFRCs with the sender's CFRCs. It's the little messenger that keeps everyone in sync 🕊️

4.1. General CFRC Requirements 💜

CFRCs in RNFD MUST support the following operations:

  • value(c): Returns a nonnegative integer value corresponding to the number of nodes counted by a given CFRC, c.
  • zero(): Returns a CFRC that counts no nodes, that is, has its value equal to 0.
  • self(): Returns a CFRC that counts only the node executing the operation.
  • infinity(): Returns a CFRC that counts all possible nodes and represents a special value, infinity.
  • merge(c1, c2): Returns a CFRC that is a union of c1 and c2 (i.e., counts all nodes that are counted by either c1, c2, or both c1 and c2).
  • compare(c1, c2): Returns the result of comparing c1 to c2.
  • saturated(c): Returns TRUE if a given CFRC, c, is saturated (i.e., no more new nodes should be counted by it); returns FALSE otherwise.

The partial ordering of CFRCs means the result of compare(c1, c2) can be one of these:

  • smaller, if c1 is ordered before c2 (i.e., c2 counts all nodes that c1 counts and at least one node that c1 does not count);
  • greater, if c1 is ordered after c2 (i.e., c1 counts all nodes that c2 counts and at least one node that c2 does not count);
  • equal, if c1 and c2 are the same (i.e., they count the same nodes); or
  • incomparable, otherwise.

In particular, zero() is smaller than all other values, and infinity() is greater than any other value. Zero is the baby, infinity is the queen 👑

The properties of merging can be formalized as follows for any c1, c2, and c3:

  • idempotence: c1 = merge(c1, c1);
  • commutativity: merge(c1, c2) = merge(c2, c1); and
  • associativity: merge(c1, merge(c2, c3)) = merge(merge(c1, c2), c3).

In particular, merge(c, zero()) always equals c, while merge(c, infinity()) always equals infinity(). Merging with nothing changes nothing, and merging with infinity is always infinity, iconic 🫠

There are many algorithmic structures that can provide the aforementioned properties of CFRC. Although in principle RNFD does not rely on any specific one, the option adopts so-called linear counting [Whang90]. Linear counting is the pick here, and that's the vibe 🌈

4.2. Format of the Option

okay so the RNFD Option is built on the generic format for RPL Control Message Options (see Section 6.7.1 of [RFC6550]) 💅. here's the layout, bestie 🎀

      0                   1                   2                   3
      0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
     |  Type = 0x0E  | Option Length |                               |
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+                               +
     |                                                               |
     +                                                               +
     |               PosCFRC, NegCFRC (Variable Length*)             |
     .                                                               .
     .                                                               .
     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Figure 2: Format of the RNFD Option

The "*" denotes that, if present, the fields have equal lengths. 🦋

  • Option Type: 0x0E 🌸
  • Option Length: an 8-bit unsigned integer that denotes the length of the option in octets, excluding the Option Type and Option Length fields. Its value MUST be even. A value of 0 denotes that RNFD is disabled in the current DODAG Version. 🙈
  • PosCFRC, NegCFRC: two variable-length, octet-aligned bit arrays carrying the sender's PositiveCFRC and NegativeCFRC, respectively. ✨

The arrays in PosCFRC and NegCFRC are the same length, and that length is derived from Option Length. Okay, here's the math 🧚 You divide Option Length by 2 to get the number of octets each array takes up. Then you multiply that by 8, and that gives you an upper bound on the number of bits in each array. The actual bit length is the largest prime number less than the upper bound. For example, if Option Length is 16, then each array takes up 8 octets, and its actual bit length is 61, since 61 is the largest prime number less than 64. 🔥

Also, these rules are a MUST, so no skipping them 👑

  • For any bit equal to 1 in the NegCFRC, the bit with the same index MUST also be equal to 1 in the PosCFRC.
  • Any unused bits (i.e., the bits beyond the actual bit length of each of the arrays) MUST be equal to 0.
  • Finally, if PosCFRC has all its bits equal to 1, then NegCFRC MUST also have all its bits equal to 1.

The CFRC operations are defined for bit arrays of a given length like this 💜

  • value(c): returns the smallest integer value not less than -LT*ln(L0/LT), where ln() is the natural logarithm function, L0 is the number of bits equal to 0 in the array corresponding to c, and LT is the bit length of the array.
  • zero(): returns an array with all bits equal to 0.
  • self(): returns an array with a single bit, selected uniformly at random, equal to 1.
  • infinity(): returns an array with all bits equal to 1.
  • merge(c1, c2): returns a bit array that constitutes a bitwise OR of c1 and c2. That is, a bit in the resulting array is equal to 0 only if the same bit is equal to 0 in both c1 and c2.
  • compare(c1, c2): returns one of these results:
    • equal, if each bit of c1 is equal to the corresponding bit of c2;
    • less, if c1 and c2 are not equal, and for each bit equal to 1 in c1, the corresponding bit in c2 is also equal to 1;
    • greater, if c1 and c2 are not equal, and for each bit equal to 1 in c2, the corresponding bit in c1 is also equal to 1; or
    • incomparable, otherwise.
  • saturated(c): returns TRUE if more than RNFD_CFRC_SATURATION_THRESHOLD of the bits in c are equal to 1; returns FALSE otherwise. 🥺

5. RPL Router Behavior

Although RNFD mostly does its own thing separately from RPL, it does need to interact with RPL and the rest of the protocol stack 🌈 These interactions are described next and can be realized, for instance, by means of event triggers. ⭐

5.1. Joining a DODAG Version and Changing the RNFD Role

Whenever RPL is running at a node and joins a DODAG Version, RNFD (if active) MUST assume the role of Acceptor for the node. So it MUST set its LORS to "UP" and its PositiveCFRC and NegativeCFRC to zero(). 🫶

The role can switch between Acceptor and Sentinel at any time. Switching from Sentinel to Acceptor has no preconditions, but switching from Acceptor to Sentinel is only possible if all of the following conditions MUST hold 👀

  1. LORS is "UP";
  2. saturated(PositiveCFRC) is FALSE;
  3. a neighbor entry for the DODAG root is present in RPL's DODAG parent set; and
  4. the neighbor is considered reachable via its link-local IPv6 address.

A role change also needs updates to LORS and CFRCs, so the node gets properly counted. When a node goes from Acceptor to Sentinel, it MUST add itself to its PositiveCFRC like this: it MUST generate a new CFRC value, selfc = self(), and it MUST replace its PositiveCFRC, denoted oldpc, with newpc = merge(oldpc, selfc). Going the other way (Sentinel to Acceptor) is different, and what happens depends on the node's value of LORS before the switch 💖

  • For "GLOBALLY DOWN", the node MUST NOT modify its LORS, PositiveCFRC, and NegativeCFRC. 💀
  • For "LOCALLY DOWN", the node MUST set its LORS to "UP" but MUST NOT modify its PositiveCFRC and NegativeCFRC. 🍓
  • For "UP" and "SUSPECTED DOWN", the node MUST set its LORS to "UP" and MUST NOT modify its PositiveCFRC, but the node MUST add itself to NegativeCFRC, by replacing its NegativeCFRC, denoted oldnc, with newnc = merge(oldnc, selfc), where selfc is the counter generated with self() when the node last added itself to its PositiveCFRC. ✨

5.2. Detecting and Verifying Problems with the DODAG Root

Only nodes that are Sentinels actually take part in detecting crashes of the DODAG root. Acceptors just pass along their observations, which show up in the CFRCs 📣

The DODAG root monitoring SHOULD be based on both internal inputs, mainly the values of CFRCs and LORS, and external inputs, like triggers from RPL and other protocols. External input monitoring SHOULD be done in a reactive way, also independently of RPL, and at both the data plane and control plane. Specifically, it is RECOMMENDED that RNFD be directly notified of events that matter for the routing adjacency maintenance mechanisms RPL relies on, like Layer 2 (L2) triggers [RFC5184] or the Neighbor Unreachability Detection [RFC4861] mechanism. Depending on the underlying protocol stack, there may be other sources of these events too, such as neighbor communication overhearing. Either way, only events about the DODAG root need to be monitored. For example, RNFD can conclude there may be problems with the DODAG root if it sees a lack of multiple consecutive L2 acknowledgments for packets the node sent over the link to the DODAG root. 🦋

On the internal side, it is RECOMMENDED that RNFD take action whenever there is a change to its local CFRCs. That way a node gets a chance to help detect potential problems even when it normally wouldn't exchange packets over the link with the DODAG root for some period. In particular, RNFD SHOULD conclude that there may be problems with the DODAG root when the fraction value(NegativeCFRC)/value(PositiveCFRC) has grown by at least RNFD_SUSPICION_GROWTH_THRESHOLD since the node last set its LORS to "UP". 📈

Whenever a node has its LORS set to "UP" and RNFD concludes (based on either external or internal inputs) that there may be problems with the link with the DODAG root, it MUST set its LORS either to "SUSPECTED DOWN" or, as an optimization, to "LOCALLY DOWN". 🚨

"SUSPECTED DOWN" is temporary. Its whole purpose is to give RNFD another chance to check whether the link with the DODAG root is really down 🕵️‍♀️ Depending on how that check turns out, RNFD MUST set its LORS to either "UP", if the link has been confirmed not to be down, or "LOCALLY DOWN", otherwise. The check can be done, for example, by sending RPL DIS or ICMPv6 Echo Request messages to the DODAG root's link-local IPv6 address and expecting replies that confirm the root is up and reachable through the link. Care should be taken not to overload the DODAG root with traffic from simultaneous probes, so random backoffs can be used for this. It is RECOMMENDED that the "SUSPECTED DOWN" value of LORS be reached and verification take place if RNFD's conclusion about the DODAG root is based only on indirect observations, like the growth of the CFRC values mentioned above. By contrast, for direct observations, such as missing L2 acknowledgments, the verification MAY be skipped, and the node's LORS goes straight from "UP" to "LOCALLY DOWN". 🧐

For consistency with RPL, RNFD also must make use of RPL's independent knowledge when it detects potential problems with the DODAG root. Specifically, a node MUST switch its LORS from "UP" or "SUSPECTED DOWN" directly to "LOCALLY DOWN" if a neighbor entry for the DODAG root is removed from RPL's DODAG parent set, or if the neighbor stops being considered reachable via its link-local IPv6 address. 🥀

Last one: while its LORS is already "LOCALLY DOWN", a node may observe that its link with the DODAG root is actually up. When that happens, it SHOULD set its LORS back to "UP", but it MUST NOT do this before conditions 2-4 in Section 5.1 all hold. Those conditions are needed for a node to change its role from Acceptor to Sentinel, so no skipping ahead 🙅‍♀️

To properly account for what the node has observed about the DODAG root, the LORS transitions above come with changes to the node's local CFRCs. Transitions between "UP" and "SUSPECTED DOWN" don't affect either CFRC. But when a node goes from "UP" or "SUSPECTED DOWN" to "LOCALLY DOWN", it MUST add itself to its NegativeCFRC, as explained previously. And by symmetry, if there is a transition from "LOCALLY DOWN" to "UP", the node MUST add itself to its PositiveCFRC, as explained previously. 🔁

Now the spicy part ☠️ If these CFRC changes happen over and over because of incorrect decisions about the status of the node's link with the DODAG root, the CFRCs can end up saturated. So an implementation should try to minimize false-positive transitions from "UP" and "SUSPECTED DOWN" to "LOCALLY DOWN". Exactly how depends on the specific solutions used for assessing the state of a link. For instance, you can use additional mechanisms to increase confidence in individual decisions (like during the verification in the "SUSPECTED DOWN" state), or you can limit the number of transitions per node, possibly in an adaptive way. 🧠✨

5.3. Disseminating Observations and Reaching Agreement 📣

Okay so nodes spread the tea by passing their CFRCs around inside the RNFD Options that ride along in link-local RPL control messages, mainly DIOs and DISs 💌. When a node gets one of these options while acting as a Sentinel or an Acceptor, it MUST update its PositiveCFRC and NegativeCFRC to newpc = merge(oldpc, recvpc) and newnc = merge(oldnc, recvnc). Here, oldpc and oldnc are the node's own PositiveCFRC and NegativeCFRC from before the update, and recvpc and recvnc are the values in the PosCFRC and NegCFRC option fields.

The fraction value(NegativeCFRC)/value(PositiveCFRC) can shift because of this. Once it reaches at least RNFD_CONSENSUS_THRESHOLD (with value(PositiveCFRC) above zero), the node agrees that the DODAG root is down ✨. So it MUST change its LORS to "GLOBALLY DOWN" and set both its PositiveCFRC and NegativeCFRC to infinity().

Once a node's LORS hits "GLOBALLY DOWN", that's the end of the line 🛑. The node MUST NOT change it, and it MUST NOT modify its CFRCs until it joins a new DODAG Version. While LORS sits at that value, RNFD MUST also stop RPL from having any DODAG parent and from advertising any Rank other than INFINITE_RANK.

Here's the Trickle part 🕰️. The RNFD Option rides along in RPL DIO messages (among others), so changes to a node's CFRCs can affect when those DIOs get sent, and that schedule is driven by the DIO Trickle timer [RFC6206]. It is RECOMMENDED to use a dedicated Trickle timer for RNFD that is different from RPL's original DIO Trickle timer. In that setup, whenever the dedicated timer fires and no DIO carrying the RNFD Option has gone to the link-local all-RPL-nodes multicast IPv6 address since the last firing, the node sends a DIO with the RNFD Option to that address. The minimal and maximal interval sizes of the dedicated timer SHOULD NOT be smaller than those of RPL's original DIO Trickle timer. Without a dedicated RNFD timer, an implementation SHOULD make sure the RNFD Option shows up in multicast DIO messages often enough to spread CFRC changes quickly, especially right after a reset of the timer triggered by RNFD.

From here on, we'll just call whichever Trickle timer RNFD uses (the dedicated one or RPL's original one, depending on the implementation) the "Trickle timer" 💜. A node MUST reset its Trickle timer when it changes its LORS to "GLOBALLY DOWN", so the news about the detected DODAG root crash spreads through the DODAG fast 🏃‍♀️. Likewise, a node SHOULD reset its Trickle timer when any of its local CFRCs change significantly.

5.4. DODAG Root's Behavior 👑

The DODAG root node MUST take on the role of Acceptor in RNFD, and it MUST NOT ever switch this role. It MUST also keep an eye on its LORS and local CFRCs so it can react to the various events that come up 👀.

To start with, the DODAG root MUST generate a new DODAG Version, which restarts the protocol, if it changes its LORS to "GLOBALLY DOWN". That can happen when the root has restarted after a crash, or when the other nodes have falsely detected its crash 🙈. It MAY also generate a new DODAG Version if the fraction value(NegativeCFRC)/value(PositiveCFRC) gets close to RNFD_CONSENSUS_THRESHOLD, which helps avoid potential interruptions to routing.

Furthermore, the DODAG root SHOULD either generate a new DODAG Version or increase the bit length of its CFRCs if saturated(PositiveCFRC) becomes TRUE. This is a self-regulation mechanism that helps tune the CFRCs for a potentially huge number of Sentinels (see Section 6.1) 🧚.

Basically, issuing a new DODAG Version restarts RNFD, so the DODAG root MAY also do this in other situations too.

5.5. Activating and Deactivating the Protocol on Demand 🎛️

RNFD can be turned on and off on demand, once per DODAG Version. The actual policies for doing that are outside the scope of this document. However, the activation and deactivation MUST be done at the DODAG root node, and other nodes MUST comply. 🫶

Here's the more specific version. When a non-root node joins a DODAG Version, RNFD at that node starts out inactive. The node MUST NOT activate the protocol unless it receives, for this DODAG Version, a valid RNFD Option containing some CFRCs, meaning its Option Length field is positive. If the option comes along with the message that makes the node join the DODAG Version, the protocol MUST be active from the moment of joining 🚀. After that, RNFD stays active at the node until it's explicitly deactivated or the node joins a new DODAG Version. An explicit deactivation MUST take place when the node receives an RNFD Option for the DODAG Version with no CFRCs, that is, with its Option Length field equal to zero. Once explicitly deactivated, RNFD MUST NOT be reactivated unless the node joins a new DODAG Version. So if the first RNFD Option the node receives has Option Length equal to zero, the protocol MUST remain deactivated for the entire time the node belongs to the current DODAG Version 🥀.

When RNFD at a node is initially inactive for a DODAG Version, the node MUST NOT attach any RNFD Option to the messages it sends. (That's partly because it might not know the desired CFRC length yet; see Section 5.6.) When the protocol has been explicitly deactivated, the node MAY also decide not to attach the option to its outgoing messages. Still, it is RECOMMENDED that it send a good number of messages with the option to the link-local all-RPL-nodes multicast IPv6 address, so its neighbors can learn that RNFD has been deactivated in the current DODAG Version 📨. In particular, it MAY reset its Trickle timer for this, but it MAY also use some reactive mechanisms. For example, it might reply with a unicast DIO or DIS containing the RNFD Option with no CFRCs to a message from a neighbor that includes the option with some CFRCs, since that neighbor seems not to have caught on that RNFD was deactivated 🙃.

5.6. Processing CFRCs of Incompatible Lengths 📏

The merge() and compare() operations on CFRCs require both arguments to be compatible, which means they have the same bit length. The processing rules for the RNFD Option (see Section 4.2) don't need that, though. This comes in handy not only for the activation and deactivation mechanisms (see Section 5.5), but also for the dynamic adjustments of CFRCs that let deployments set their own policies (see Section 6.1). So a node has to be ready to receive an RNFD Option whose PosCFRC and NegCFRC fields have a different bit length from its own PositiveCFRC and NegativeCFRC 🌈. Assuming RNFD is active at the node and the PosCFRC and NegCFRC fields in the option have a positive length, the node MUST react as follows.

If the bit length of PosCFRC and NegCFRC is the same as that of the node's local PositiveCFRC and NegativeCFRC, then the node MUST perform the merges, as detailed previously (see Section 5.3).

If the bit length of PosCFRC and NegCFRC is smaller than that of the node's local PositiveCFRC and NegativeCFRC, then the node MUST ignore the option and MAY reset its Trickle timer.

If the bit length of PosCFRC and NegCFRC is greater than that of the node's local PositiveCFRC and NegativeCFRC, then the node MUST extend the bit length of its local CFRCs to be equal to that in the option and set the CFRCs as follows:

  • If the node's LORS is "GLOBALLY DOWN", then both of its local CFRCs MUST be set to infinity().
  • Otherwise, they both MUST be set to zero(), and the node MUST account for itself in so initialized CFRCs. More specifically, if the node is a Sentinel, then it MUST add itself to its PositiveCFRC, as detailed previously. In addition, if its LORS is "LOCALLY DOWN", then it MUST also add itself to its NegativeCFRC, as explained previously. Finally, the node MUST perform merges of its local CFRCs and the ones received in the option (see Section 5.3) and MAY reset its Trickle timer 💫.

In contrast, if the node is unable to extend its local CFRCs, for example because it lacks resources, then it MUST stop participating in RNFD. That is, until it joins a new DODAG Version, it MUST NOT send the RNFD Option and MUST ignore this option in received messages 🚫.

A DODAG root node can be asked to increase the bit length of its CFRCs from the outside, as part of the management policies (see Section 6.1). If it can't fulfill such a request, then it MUST NOT stop participating in RNFD and SHOULD return an error to the requester instead. Otherwise, since the root is always an Acceptor, the above rules require it to extend both CFRCs to the requested length and to set them both to zero() when its LORS is different from "GLOBALLY DOWN", or to infinity() when its LORS is equal to "GLOBALLY DOWN". In that second case, given the earlier rules governing the root's behavior upon reaching the "GLOBALLY DOWN" state (cf. Section 5.4), the root is also bound to eventually set its CFRCs to zero() and, in addition, generate a new DODAG Version and change its LORS back to "UP". So these two steps can be optimized into one: no matter what its LORS is, when the root increases the bit length of its CFRCs in response to an external request, it also sets the CFRCs to zero() ✅.

5.7. Summary of RNFD's Interactions with RPL 🧩

Quick recap of how RNFD and RPL work together 💅:

  • While its LORS is "GLOBALLY DOWN", RNFD stops RPL from routing packets and advertising upward routes in the corresponding DODAG (see Section 5.3).
  • In some scenarios, RNFD triggers RPL to issue a new DODAG Version (see Section 5.4).
  • Depending on the implementation, RNFD might cause resets of RPL's DIO Trickle timer (see Sections 5.3, 5.5, and 5.6).
  • RNFD keeps tabs on events relevant to routing adjacency maintenance, as well as events affecting RPL's DODAG parent set (see Sections 5.1 and 5.2).
  • Using RNFD means embedding the RNFD Option into link-local RPL control messages (see Section 4.2) 🦋.

5.8. Summary of RNFD's Constants ✨

okay bestie, let's do a quick recap of RNFD's constants 💅 there are three thresholds you need to know, and they're all about the same fraction, value(NegativeCFRC)/value(PositiveCFRC) 🔥

RNFD_CONSENSUS_THRESHOLD: this one decides when the group has basically agreed the DODAG root is down 👑 when a Sentinel or Acceptor node hits this threshold, its LORS gets set to "GLOBALLY DOWN", and that means consensus has been reached on the root being down (check Section 5.3 for the full tea ☕). the default is 0.51, which just means a majority of Sentinels have to think the root is down before the group agrees 🫶 higher value = longer detection time but way fewer false positives 🦋

RNFD_SUSPICION_GROWTH_THRESHOLD: this one is about getting suspicious 👀 if the fraction at a Sentinel node grows by at least this much since its LORS was last set to "UP", the node flips to "SUSPECTED DOWN" or "LOCALLY DOWN", meaning it's starting to suspect or basically assumes the root crashed (see Section 5.2). higher value = crash detection takes longer, but less extra traffic from verifying false alarms 🌸 the default is 0.12, and in sparse networks (up to 8 neighbors per node) one other Sentinel calling the root dead is enough to trigger suspicion 😭 denser networks get more and more conservative 🧚

RNFD_CFRC_SATURATION_THRESHOLD: this one is about how full a CFRC is 🍓 it's about the percentage of bits set to 1 in a CFRC, c. if that percentage is equal to or greater than the threshold, saturated(c) returns TRUE, which is a hint for the DODAG root to either issue a new DODAG Version or increase the bit length of the CFRCs (see Section 5.4) 💖 the default is 0.63, and higher means more bit collisions, so value(c) can get kinda erratic 🙈

how these constants get configured on individual nodes is outside the scope of this document, so that's a problem for another day 💜

6. Manageability Considerations 🎀

RNFD is mostly self-managed 🧚 the only things you can really poke at are protocol activation and deactivation, plus node role assignment and the related CFRC size adjustment. for those, only the mechanisms above are defined, so deployments can bring their own policies 💅 this section walks through the manageability stuff 🦋

6.1. Role Assignment and CFRC Size Adjustment 🍓

one approach is to manually pick specific nodes to be Sentinels in RNFD 👑 you're assuming they'll get the chance to meet the necessary conditions for that role (see Section 5.1), and you fix the CFRC bit length so it fits those nodes 🫶

another approach is to automate the whole selection thing ✨ in theory, any node that meets the necessary conditions for becoming a Sentinel (see Section 5.1) can get the role 💖 but in networks where the DODAG root has a ton of neighbors, saturated(PositiveCFRC) can flip to TRUE really fast 😭 and that can tank RNFD's performance unless you add extra measures 💀

there's a probabilistic fix for this 🧚 if PositiveCFRC gets saturated with little or no increase in NegativeCFRC, you can issue a new DODAG Version, and then a node that meets the necessary conditions only becomes a Sentinel in that version with probability 1/2 🌈 you keep going, halving the probability each new DODAG Version, until PositiveCFRC isn't getting saturated super quickly anymore 🔥

another fix is to increase the bit length of the CFRCs, maybe more than once, if PositiveCFRC gets saturated with little or no growth in NegativeCFRC 🎀 the DODAG root does this, and it doesn't need a new DODAG Version, but it does make the RNFD Option longer 🙈 that way you can dynamically find a bit length that's big enough, or the root can decide a bit length is too much for (some) nodes and go back to the previous solution 💅 increasing the bit length can be done by doubling it, for example, as long as the result is a prime number (see Section 4.2) 🦋

either way, Sentinel nodes should ideally be stable themselves and have stable links to the DODAG root 🫶 otherwise they keep bouncing between "UP" and "LOCALLY DOWN" or switching between Acceptor and Sentinel roles, and that slowly saturates the CFRCs 😭 as a mitigation, you MAY limit how many of those transitions and switches happen per node; however, having Sentinels be stable SHOULD be preferred 💜

6.2. Virtual DODAG Roots 👑

RPL lets a DODAG have a so-called "virtual root" 🧚 that's a bunch of nodes coordinating to act as one single root of the DODAG ✨ the coordination details are left open in [RFC6550], but from RNFD's point of view, there are two possible setups worth thinking about 🌸

  • just one primary node out of the virtual root's nodes acts as the actual root of the DODAG 💖 a backup node only takes over if that primary fails 🫶 so at any time, at most one of the virtual root's nodes is the actual root 🔥
  • more than one of the virtual root's nodes act as actual roots of the DODAG, all advertising the same Rank in the DODAG 🌈 when some of them fail, the others may or may not react in any specific way 🙈 basically, at any time, more than one node can be the actual root 🦋

in the first setup, RNFD mostly keeps working as normal 💅 the necessary conditions for a node to become a Sentinel (Section 5.1) make sure only the current primary root node gets monitored by the protocol ✨ this SHOULD be taken into account in the policies for node role assignment, CFRC size selection, and possibly the setting of the three thresholds (Section 5.8) 🍓 and when a new primary gets elected, a new DODAG Version MUST be issued, so the CFRCs don't get polluted with observations about the previous primary 😭

in the second setup, the fact that the virtual root is made of multiple nodes is invisible to RNFD 🧚 so using RNFD there is only worth it if the nodes in the virtual root might suffer correlated crashes, like from global power outages ⭐

6.3. Monitoring 🌸

for monitoring how RNFD is doing, its implementation SHOULD give you the following info about a node 💜

  • whether the protocol is active, and
  • whether LORS is "GLOBALLY DOWN"

that info MUST come with the monitoring parameters defined by RPL [RFC6550], including at least the DODAG Version Number and the Rank 💖 for even finer-grained visibility into RNFD's state at the node, the implementation MAY also provide 👀

  • the assigned role (i.e., Sentinel or Acceptor),
  • the exact value of LORS (i.e., "UP", "SUSPECTED DOWN", "LOCALLY DOWN", or "GLOBALLY DOWN"),
  • the two CFRCs (i.e., PositiveCFRC and NegativeCFRC), and
  • the constants listed in Section 5.8.

7. Security Considerations 💀

okay, this section is seriously important, so bestie, read it carefully 😭🫶

RNFD is an extension to RPL, so it's vulnerable to and benefits from the security issues and solutions described in [RFC6550] and [RFC7416] 🔥 its spec in this document doesn't add new traffic patterns or new messages, so there aren't any specific mitigation techniques needed beyond what you can already use for RPL 💅

RNFD depends on information exchanged in the RNFD Option 🎀 if the contents of this option get compromised, failure misdetection can happen 😱 one possibility is that the DODAG root gets falsely detected as crashed, which means nodes can't route packets, at least until the root issues a new DODAG Version 💀 another possibility is that a crash of the DODAG root doesn't get detected by RNFD, and then RPL would have to rely on its own mechanisms 🙈 also, compromising the RNFD Option can lead to more DIO traffic because of Trickle timer resets 🌈 so RNFD deployments are RECOMMENDED to use RPL security mechanisms if there's a risk that control information might be modified or spoofed 🫶

two features of RNFD are worth highlighting here ✨ first, unless all neighbors of a DODAG root are compromised, a false positive can always be detected by the root based on its local CFRCs 👑 if these false positives become a problem, RNFD can be disabled altogether, for example until the problem is diagnosed 🦋 this can be mostly automated at LBRs 🧚 second, some types of false negatives can also be detected this way 💖 the ones that slip through probably won't cause major trouble for RPL, apart from not improving its performance when a DODAG root crashes, at least if RPL's other components aren't attacked too 🌸

8. IANA Considerations 🌈

IANA has allocated the following value in the "RPL Control Message Options" registry within the "Routing Protocol for Low Power and Lossy Networks (RPL)" registry group (https://www.iana.org/assignments/rpl) 💅

                    +=======+=============+===========+
                    | Value | Meaning     | Reference |
                    +=======+=============+===========+
                    | 0x0E  | RNFD Option | RFC 9866  |
                    +-------+-------------+-----------+

                                  Table 1

9. References 📚

9.1. Normative References 🎀

9.2. Informative References ✨

okay so this is the bit where the RFC shows its homework 📚🎀 these are the extra reads that back up the vibes, and they're not required to implement the thing, just lowkey gorgeous to know about 🫶

  • [Ciolkosz19] Ciolkosz, P., "Integration of the RNFD Algorithm for Border Router Failure Detection with the RPL Standard for Routing IPv6 Packets", Master's Thesis, University of Warsaw, 2019.
  • [Iwanicki16] Iwanicki, K., "RNFD: Routing-Layer Detection of DODAG (Root) Node Failures in Low-Power Wireless Networks", 2016 15th ACM/IEEE International Conference on Information Processing in Sensor Networks (IPSN), pp. 1-12, DOI 10.1109/IPSN.2016.7460720, 2016, <https://doi.org/10.1109/IPSN.2016.7460720>. this one is the OG RNFD paper and it's giving main character energy 💅
  • [Paszkowska19] Paszkowska, A. and K. Iwanicki, "Failure Handling in RPL Implementations: An Experimental Qualitative Study", Mission-Oriented Sensor Networks and Systems: Art and Science, Springer International Publishing, pp. 49-95, DOI 10.1007/978-3-319-91146-5_3, 2019, <https://doi.org/10.1007/978-3-319-91146-5_3>. real talk, researching how RPL implementations actually handle failures is so iconic 🔥
  • [RFC4861] Narten, T., Nordmark, E., Simpson, W., and H. Soliman, "Neighbor Discovery for IP version 6 (IPv6)", RFC 4861, DOI 10.17487/RFC4861, September 2007, <https://www.rfc-editor.org/info/rfc4861>. ND is the foundation everything else is built on, so obviously we're citing it 🧚
  • [RFC5184] Teraoka, F., Gogo, K., Mitsuya, K., Shibui, R., and K. Mitani, "Unified Layer 2 (L2) Abstractions for Layer 3 (L3)-Driven Fast Handover", RFC 5184, DOI 10.17487/RFC5184, May 2008, <https://www.rfc-editor.org/info/rfc5184>. fast handover with unified L2 abstractions? the way that this is so relevant 😭
  • [RFC7102] Vasseur, JP., "Terms Used in Routing for Low-Power and Lossy Networks", RFC 7102, DOI 10.17487/RFC7102, January 2014, <https://www.rfc-editor.org/info/rfc7102>. the glossary bestie, read this first and thank me later 🌸
  • [RFC7228] Bormann, C., Ersue, M., and A. Keranen, "Terminology for Constrained-Node Networks", RFC 7228, DOI 10.17487/RFC7228, May 2014, <https://www.rfc-editor.org/info/rfc7228>. constrained devices are their whole personality and this doc explains it 🦋
  • [RFC7416] Tsao, T., Alexander, R., Dohler, M., Daza, V., Lozano, A., and M. Richardson, Ed., "A Security Threat Analysis for the Routing Protocol for Low-Power and Lossy Networks (RPLs)", RFC 7416, DOI 10.17487/RFC7416, January 2015, <https://www.rfc-editor.org/info/rfc7416>. security threats to RPL? yes we're reading this, no notes 💀
  • [Whang90] Whang, K.-Y., Vander-Zanden, B.T., and H.M. Taylor, "A Linear-time Probabilistic Counting Algorithm for Database Applications", ACM Transactions on Database Systems (TODS), vol. 15, no. 2, pp. 208-229, DOI 10.1145/78922.78925, 1990, <https://doi.org/10.1145/78922.78925>. probabilistic counting from 1990 and it still slaps 👑

Acknowledgements ✨

the author gave a big shoutout to Piotr Ciolkosz and Agnieszka Paszkowska 🫶 Agnieszka helped deepen everyone's understanding and formally proved various aspects of how RPL behaves when an LBR crashes, which is a whole mood 🧠✨ and Piotr built a prototype implementation of RNFD dedicated to RPL so the earlier performance claims could actually be checked 🔥 absolutely iconic teamwork, bestie 💖

Author's Address 🦋

Konrad Iwanicki
University of Warsaw
Banacha 2
02-097 Warszawa
Poland
Phone: +48 22 55 44 428
Email: iwanicki@mimuw.edu.pl
📦 where this page comes from