TOC |
|
By submitting this Internet-Draft, each author represents that any applicable patent or other IPR claims of which he or she is aware have been or will be disclosed, and any of which he or she becomes aware will be disclosed, in accordance with Section 6 of BCP 79.
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet-Drafts.
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as “work in progress.”
The list of current Internet-Drafts can be accessed at http://www.ietf.org/ietf/1id-abstracts.txt.
The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html.
This Internet-Draft will expire on May 8, 2009.
This memo defines ICMP extensions, using ICMP multi-part messages, through which a router or host can explicitly identify an interface by ifIndex, name, and/or address, as already used in MIBs and by OSPF. The interfaces so identified can be the interface upon which an undeliverable datagram arrived, a sub-IP member of that interface, and the interface through which the datagram would have been sent. The nexthop IP address can also be provided as part of the outgoing interface information. The extensions defined herein are particularly useful when troubleshooting networks with unnumbered interfaces, parallel interfaces and/or asymmetric routing.
1.
Conventions Used In This Document
2.
Introduction
3.
Applications
3.1.
Application to Traceroute
3.2.
Policy and MTU Detection
4.
Interface Information Object
4.1.
C-type meaning in an Interface Information Object
4.2.
Interface Name Sub-Object
4.3.
Interface Information Object Examples
4.4.
Usage
5.
Network Address Translation Considerations
6.
Security Considerations
7.
IANA Considerations
8.
Acknowledgements
9.
References
9.1.
Normative References
9.2.
Informative References
§
Authors' Addresses
§
Intellectual Property and Copyright Statements
TOC |
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC2119 (Bradner, S., “Key words for use in RFCs to Indicate Requirement Levels,” March 1997.) [RFC2119].
TOC |
IP devices use the Internet Control Message Protocol (ICMP) (Postel, J., “Internet Control Message Protocol,” September 1981.) [RFC0792] (ICMPv6) (Conta, A., Deering, S., and M. Gupta, “Internet Control Message Protocol (ICMPv6) for the Internet Protocol Version 6 (IPv6) Specification,” March 2006.) [RFC4443] to convey control information. In particular, when an IP device receives a datagram that it cannot forward, it may send an ICMP message to the datagram's originator. Network operators and higher level protocols use these ICMP messages to detect and diagnose network issues.
In the nominal case, the source address of the ICMP message identifies the interface upon which the non-forwardable datagram arrived. However, in many cases, the incoming interface is not identified by the ICMP message at all. Details follow:
According to RFC1812 (Baker, F., “Requirements for IP Version 4 Routers,” June 1995.) [RFC1812], when a router generates an ICMP message, the source address of that ICMP message MUST be one of the following:
If the following conditions are true, the source address of the ICMP message identifies the interface upon which the non-forwardable datagram arrived:
However, the transmitting and incoming interfaces may be different due to an asymmetric return path, which can occur due to asymmetric link costs, parallel links or ECMP.
For ICMPv6, the asymmetric issues need not be an issue, since there is more flexibility for ICMPv6, as defined in RFC4443 (Conta, A., Deering, S., and M. Gupta, “Internet Control Message Protocol (ICMPv6) for the Internet Protocol Version 6 (IPv6) Specification,” March 2006.) [RFC4443]. For responses to messages sent to addresses that aren't the router's, the source address must be chosen as follows:
For both ICMP and ICMPv6, when a network uses unnumbered interfaces, it is not possible to identify the incoming interface. The extension defined in this memo permit an ICMP originator to identify the interface through which the datagram that elicited the ICMP message arrived.
Using the extension defined herein, an IP device can explicitly identify the incoming interface by any or all of the following:
Using the same extension, an IP device can explicitly identify by the above the outgoing interface over which a datagram would have been forwarded if that datagram had been deliverable.
The next-hop IP address, over which the datagram would have been forwarded, can also be provided via this same extension. This information can be used for creating a downstream map. The next-hop information may not always be available. There are corner-cases, such as point-to-point unnumbered links, where it doesn't exist. There may be implementations where it is not practical to provide this information. This specification provides an encoding for providing the next-hop IP address when it is available.
The extension defined herein use the ICMP multi-part message framework defined in [RFC4884] (Bonica, R., Gan, D., Tappan, D., and C. Pignataro, “Extended ICMP to Support Multi-Part Messages,” April 2007.). The same backward compatibility issues that apply to [RFC4884] (Bonica, R., Gan, D., Tappan, D., and C. Pignataro, “Extended ICMP to Support Multi-Part Messages,” April 2007.) apply to this extension.
TOC |
TOC |
ICMP extensions defined in this memo require enhancements ([RFC4884] (Bonica, R., Gan, D., Tappan, D., and C. Pignataro, “Extended ICMP to Support Multi-Part Messages,” April 2007.)) and provide additional capability to traceroute. The enhanced traceroute application, like older implementations, indicates which nodes the original datagram visited en route to its destination. It differs from older implementations in that it also reflects the incoming interface on which the original triggering packet arrived, even when that interface is unnumbered.
TOC |
A general application would be to identify which outgoing interface triggered a given function for the original packet. For example, if an ACL drops the packet and Dest Unreachable/Admin Prohibited denies the packet, being able to identify the outgoing interface might be useful. Another example would be to support PMTU, since this would allow identification of which outgoing interface can't support a given MTU size. For example, knowledge of the problematic interface would allow an informed request for reconfiguration of the MTU of that interface.
TOC |
This section defines an ICMP extension object that can be appended to the ICMPv4 Time Exceeded, ICMPv4 Destination Unreachable, ICMPv4 Parameter Problem, ICMPv6 Time Exceeded, and ICMPv6 Destination Unreachable messages, as described in [RFC4884] (Bonica, R., Gan, D., Tappan, D., and C. Pignataro, “Extended ICMP to Support Multi-Part Messages,” April 2007.). For the description of the Interface Information Object, the incoming interface is the one upon which the packet which triggered the ICMP message was received. If desired, information about a sub-IP member of the incoming interface can be included. An example of such a sub-IP member would be a member of an Ethernet Link Aggregation Group that forms the incoming interface. To minimize the use of extra octets required for this extension, there are four different pieces of information that can appear in an Interface Information Object.
TOC |
For this object, the c-type is used to indicate both the role of the interface and the information that is included. This is illustrated below.
Bit 7 6 5 4 3 2 1 0 +-------+-------+-------+-------+-------+-------+---------+-------+ | Interface Role| Rsvd1 | Rsvd2 | index | IP | nexthop | name | +-------+-------+-------+-------+-------+-------+---------+-------+ Interface Role: This 2-bit field [6:7] indicates the role of the interface being identified. The enumerated values are given below. 0 : This object describes the incoming interface. 1 : This object describes the outgoing interface. 2 : This object describes a sub-IP member of the incoming interface. 3 : Reserved bit : Field Name : description 5 : Reserved 1 : This bit is reserved for future use and MUST be set to 0 and MUST be ignored on receipt. 4 : Reserved 2 : This bit is reserved for future use and MUST be set to 0 and MUST be ignored on receipt. 3 : ifIndex : When set, this bit indicates the 32-bit ifIndex of the interface is included. When clear, the ifIndex is not included. 2 :IP address : When set, this indicates an IP address of the interface is included. When clear, no IP address is included. The version of the IP packet containing the ICMP message will indicate the type of IP address. An IPv4 packet will have an IPv4 address; an IPv6 packet will have an IPv6 address. 1 : Next-hop : This MUST be clear unless the Interface Role is 3, indicating an outgoing interface. When this flag is set, this indicates that the next-hop IP address is included. When clear, no IP address is included. The version of the IP packet containing the ICMP message will indicate the type of IP address. An IPv4 packet will include an IPv4 address and an IPv6 packet will include an IPv6 address. 0 : Interface Name: When set, this indicates an Interface Name Sub-object for the interface is included. When clear, it is not included.
Figure 1: C-Type for the Interface Information Object |
With the exception of the Interface Name sub-object, the information included does not self-identify, so this specification defines a specific ordering for sending the information which must be followed.
If bit 3 (ifIndex) is set, then the 32-bit ifIndex MUST be sent first. If bit 2 (IP address) is set, then either an IPv4 address or an IPv6 address, depending on packet version, MUST be sent next. If bit 0 (Interface Name) is set, then an Interface Name Sub-object MUST be sent next. If bit 1 (Next-hop) is set, then the next-hop is given in either an IPv4 address or an IPv6 address, depending on the packet version. The information order is thus: ifIndex, IP address, Interface Name sub-object, next-hop; any or all pieces of information may be present or absent, as indicated by the c-type. Any data that follows these optional pieces of information MUST be ignored.
The sender of an Interface Information Object MUST NOT set the Interface Role to 3 and an Interface Role value of 3 MUST be ignored on receipt and the Interface Information Object discarded. It is valid (though pointless until additional bits are assigned by IANA) to receive an Interface Information Object where bits 3, 2, 1 and 0 are all 0; this MUST NOT generate a warning or error.
TOC |
The Interface Name Sub-Object MUST have a length that is a multiple of 4 octets and MUST NOT exceed 64 octets. A one octet "charset type" and a one octet "length" are required and the interface name can be at most 62 octets long. The interface name SHOULD be the full MIB-II ifName [RFC2863] (McCloghrie, K. and F. Kastenholz, “The Interfaces Group MIB,” June 2000.), if less than 63 octets, or the first 62 octets of the ifName, if the ifName is longer. The interface name MAY be some other human-meaningful name of the interface. It is useful to provide the ifName for cross-correlation with other MIB information and for human-reader familiarity.
The Interface Name Sub-Object consists of three fields. The first 1-octet field indicates the character set type used by the second field. The second field contains the length of the Interface name Sub-object, including the charset type, the length, and the human-readable name in octets. The maximum valid length is 64 octets. The length is constrained to ensure there is space for the start of the original packet and additional information. The third field contains the human-readable name.
octet 0 1 2 63 +--------------+--------+---..............-----------------+ | charset type | length | interface name octets 1-62 | +--------------+--------+---..............-----------------+
Figure 2: Interface Name Sub-Object |
charset type 0 : This indicates that the human-readable interface name MUST be provided in the US-ASCII charset [US‑ASCII] (, “Coded Character Set -- 7-bit American Standard Code for Information Interchange, ANSI X3.4-1986,” .) using the Default Language [RFC2277] (Alvestrand, H., “IETF Policy on Character Sets and Languages,” January 1998.).
charset type 1 : This indicates that the human-readable interface name MUST be provided in the UTF-8 charset [RFC3629] (Yergeau, F., “UTF-8, a transformation format of ISO 10646,” November 2003.) using the Default Language [RFC2277] (Alvestrand, H., “IETF Policy on Character Sets and Languages,” January 1998.).
TOC |
Figure 3 (ICMPv4 Time Exceeded message with Interface Information Object) shows a full ICMPv4 Time Exceeded message, including the Interface Information Object, which must be preceded by an ICMP Extension Structure Header and an ICMP Object Header. Both are defined in [RFC4884] (Bonica, R., Gan, D., Tappan, D., and C. Pignataro, “Extended ICMP to Support Multi-Part Messages,” April 2007.).
Figure 4 (Interface Information Object) depicts the Interface Information Object, with four of the valid permutations.
Although all examples show an Interface Name Sub-object of length 64, this is only for illustration and depicts the maximum allowable length.
0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Type | Code | Checksum | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | unused | Length | unused | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Internet Header + leading octets of original datagram | | | | // | | | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Ver=2 | (Reserved) | Checksum | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Length |Class-Num=2 | C-Type=00001001b | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Interface ifIndex | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Interface Name, 32-bit word 1 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ... ... +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Interface Name , 32-bit word 16 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 3: ICMPv4 Time Exceeded message with Interface Information Object |
Class-Num = 2 Example 1: Unnumbered Interface with ifIndex and interface name C-Type = 00001001b // Indicates incoming interface Length = 40 (4 + 4 + 32) 0 1 2 3 +--------------+--------------+--------------+--------------+ | Interface ifIndex | +--------------+--------------+--------------+--------------+ | Interface Name, 32-bit word 1 | +--------------+--------------+--------------+--------------+ ... ... +--------------+--------------+--------------+--------------+ | Interface Name , 32-bit word 16 | +--------------+--------------+--------------+--------------+ Example 2: IPv4 interface with IPv4 address, ifIndex and interface name C-Type = 00001101b // Indicates incoming interface Length = 44 (4 + 4 + 4 + 32) 0 1 2 3 +--------------+--------------+--------------+--------------+ | Interface ifIndex | +--------------+--------------+--------------+--------------+ | IPv4 address | +--------------+--------------+--------------+--------------+ | Interface Name, 32-bit word 1 | +--------------+--------------+--------------+--------------+ ... ... +--------------+--------------+--------------+--------------+ | Interface Name, 32-bit word 16 | +--------------+--------------+--------------+--------------+ Example 3: IPv6 interface with IPv6 address and ifIndex C-Type = 00001100b // Indicates incoming interface Length = 24 (4 + 4 + 16) 0 1 2 3 +--------------+--------------+--------------+--------------+ | Interface ifIndex | +--------------+--------------+--------------+--------------+ | IPv6 address, 32-bit word 1 | +--------------+--------------+--------------+--------------+ | IPv6 address, 32-bit word 2 | +--------------+--------------+--------------+--------------+ | IPv6 address, 32-bit word 3 | +--------------+--------------+--------------+--------------+ | IPv6 address, 32-bit word 4 | +--------------+--------------+--------------+--------------+ Example 4: outgoing IPv4 interface with IPv4 address, next-hop IPv4 address C-Type = 10000110b // Indicates incoming interface Length = 44 (4 + 4) 0 1 2 3 +--------------+--------------+--------------+--------------+ | outgoing interface's IPv4 address | +--------------+--------------+--------------+--------------+ | next-hop IPv4 address | +--------------+--------------+--------------+--------------+
Figure 4: Interface Information Object |
TOC |
For each interface described by an included Interface Information Object, these are the rules for the information to be included. If the interface in question is unnumbered, then the Interface Information Object SHOULD include the ifIndex and MUST NOT include an IP address. If the interface in question is numbered, then the Interface Information Object SHOULD include the IP address. Other fields MAY be included in the Interface Information Object.
In an ICMP message, more than one Interface Information Object with a given interface role MUST NOT be included. Multiple Interface Information Objects, each with a different interface role, MAY be included.
TOC |
[I‑D.ietf‑behave‑nat‑icmp] (Srisuresh, P., Ford, B., Sivakumar, S., and S. Guha, “NAT Behavioral Requirements for ICMP protocol,” January 2009.) encourages Traditional IP Network Address Translators (Traditional NATs, see [RFC3022] (Srisuresh, P. and K. Egevang, “Traditional IP Network Address Translator (Traditional NAT),” January 2001.)) to support ICMP extension objects. This document defines an ICMP extension that includes IP addresses and therefore contain realm specific information, and consequently describes possible NAT behaviors in presence of these extensions.
In the most general case, a NAT device may choose to transparently pass, remove or overwrite this extension. The action may be different for the different fields: The ifIndex can either be transparently passed or removed, the Description can be transparently passed, removed or re-written (adding some text to the effect that a NAT was crossed and the description was removed, as a matter of policy or other), and IP addresses can either be passed, removed or translated.
When translating IP address-related fields of the extension defined in this document, the behavior should be equivalent to that of the treatment of Router-x and Router-y source IP address in Sections 4.2.1 and 4.2.2 of [I‑D.ietf‑behave‑nat‑icmp] (Srisuresh, P., Ford, B., Sivakumar, S., and S. Guha, “NAT Behavioral Requirements for ICMP protocol,” January 2009.)(respectively). That is:
These recommendations allow for the improved troubleshooting offered by this extension while not leaking private-realm addresses outside. A NAT SHOULD follow the recommendations in this section; it MAY choose to pass the extension unaltered.
TOC |
This extension can provide the user of traceroute with additional network information that is not currently available. It may be desirable to provide this information to a particular network's operators and not to others. If such policy controls are desirable, then an implementation could determine what sub-objects to include based upon the destination IP address of the ICMP message that will contain the sub-objects. The implementation of policy controls could also be based upon the mechanisms described in [I‑D.shen‑udp‑traceroute‑ext] (Shen, N., Pignataro, C., Asati, R., and E. Chen, “UDP Traceroute Message Extension,” June 2008.) for those limited cases supported.
For instance, the IP address may be included for all potential recipients. The ifIndex and interface name could be included as well if the destination IP address is a management address of the network that has administrative control of the router.
Another example use case would be where the detailed information in these extensions may be provided to ICMP destinations within the local administrative domain, but only traditional information is provided to 'external' or untrusted ICMP destinations.
TOC |
IANA should reserve from the ICMP Extension Object registry: 2 for the Interface Information Object.
From the Interface ID Object's c-type, IANA should reserve as follows:
Additionally, the Interface Name Sub-Object has a 1 octet charset type field. IANA should create a registry for it and allocate as follows:
TOC |
The authors would like to thank Carlos Pignataro, Sasha Vainshtein, and Joe Touch for their comments and suggestions.
TOC |
TOC |
[RFC0792] | Postel, J., “Internet Control Message Protocol,” STD 5, RFC 792, September 1981 (TXT). |
[RFC2119] | Bradner, S., “Key words for use in RFCs to Indicate Requirement Levels,” BCP 14, RFC 2119, March 1997 (TXT, HTML, XML). |
[RFC2863] | McCloghrie, K. and F. Kastenholz, “The Interfaces Group MIB,” RFC 2863, June 2000 (TXT). |
[RFC4443] | Conta, A., Deering, S., and M. Gupta, “Internet Control Message Protocol (ICMPv6) for the Internet Protocol Version 6 (IPv6) Specification,” RFC 4443, March 2006 (TXT). |
[RFC4884] | Bonica, R., Gan, D., Tappan, D., and C. Pignataro, “Extended ICMP to Support Multi-Part Messages,” RFC 4884, April 2007 (TXT). |
TOC |
[I-D.ietf-behave-nat-icmp] | Srisuresh, P., Ford, B., Sivakumar, S., and S. Guha, “NAT Behavioral Requirements for ICMP protocol,” draft-ietf-behave-nat-icmp-12 (work in progress), January 2009 (TXT). |
[I-D.shen-udp-traceroute-ext] | Shen, N., Pignataro, C., Asati, R., and E. Chen, “UDP Traceroute Message Extension,” draft-shen-udp-traceroute-ext-01 (work in progress), June 2008 (TXT). |
[RFC1812] | Baker, F., “Requirements for IP Version 4 Routers,” RFC 1812, June 1995 (TXT). |
[RFC2277] | Alvestrand, H., “IETF Policy on Character Sets and Languages,” BCP 18, RFC 2277, January 1998 (TXT, HTML, XML). |
[RFC3022] | Srisuresh, P. and K. Egevang, “Traditional IP Network Address Translator (Traditional NAT),” RFC 3022, January 2001 (TXT). |
[RFC3629] | Yergeau, F., “UTF-8, a transformation format of ISO 10646,” STD 63, RFC 3629, November 2003 (TXT). |
[US-ASCII] | “Coded Character Set -- 7-bit American Standard Code for Information Interchange, ANSI X3.4-1986.” |
TOC |
Alia K. Atlas (editor) | |
BT | |
Email: | alia.atlas@bt.com |
Ronald P. Bonica | |
Juniper Networks | |
2251 Corporate Park Drive | |
Herndon, VA 20171 | |
USA | |
Email: | rbonica@juniper.net |
J.R. Rivers | |
Nuova Systems | |
Email: | jrrivers@nuovasystems.com |
Naiming Shen | |
Cisco Systems | |
225 West Tasman Drive | |
San Jose, CA 95134 | |
USA | |
Email: | naiming@cisco.com |
Enke Chen | |
Cisco Systems | |
170 West Tasman Drive | |
San Jose, CA 95134 | |
USA | |
Email: | enkechen@cisco.com |
TOC |
Copyright © The IETF Trust (2008).
This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.
This document and the information contained herein are provided on an “AS IS” basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org.