A One-way Active Measurement Protocol (OWAMP)
updated by
- rfc-7717 — IKEv2-Derived Shared Secret Key for the One-Way Active Measurement Protocol (OWAMP) and Two-Way Active Measurement Protocol (TWAMP)
- rfc-7718 — Registries for the One-Way Active Measurement Protocol (OWAMP)
- rfc-8545 — Well-Known Port Assignments for the One-Way Active Measurement Protocol (OWAMP) and the Two-Way Active Measurement Protocol (TWAMP)
Extracted elements (31)
AES-ECB (not CBC) is used for the first block of OWAMP-Test packets in authenticated mode, and each encrypted packet in encrypted mode uses an independent CBC stream with IV=0. This ensures that lost, duplicated, or reordered UDP packets do not corrupt decryption of other packets in the session.
In authenticated mode, the timestamp is sent in cleartext while only the sequence number block is AES-ECB encrypted. This allows the sender to record and transmit the timestamp without an encryption step in the critical path, improving timestamp accuracy compared to encrypted mode where the timestamp must be fetched and then encrypted before sending.
OWAMP test traffic is intentionally hard to detect: it is a stream of UDP packets between negotiated ports with negotiated size, and in encrypted mode there is nothing static in the packets. This makes interference or special treatment by intermediaries more difficult, protecting measurement integrity.
OWAMP uses Knuth's Algorithm S (ziggurat family) for generating exponential random variates rather than a log-based algorithm. Log-based algorithms produce potentially different floating-point results across implementations, which would cause sender and receiver to compute divergent packet schedules and misattribute lost packets.
An OWAMP server SHOULD listen on well-known TCP port 861. An implementation SHOULD expunge unused state (e.g., drop the TCP connection if a full control message is not received within approximately 30 minutes) to prevent denial-of-service attacks or unbounded memory usage.
Count in the Server Greeting MUST be a power of 2 and MUST be at least 1024; it SHOULD be increased as computing power grows. Salt MUST be generated pseudo-randomly, independently of all other protocol values. These are parameters for PBKDF2 key derivation.
Each OWAMP-Test packet actually sent MUST carry the best possible approximation of its real departure time as its timestamp. If a scheduled send time is in the past by more than Timeout, the sender MUST NOT send the packet (the receiver would consider it lost regardless). The sender MUST track skipped packets and report them via Skip Ranges in Stop-Sessions.
If a receiver learns via Stop-Sessions that the sender's last sequence number is lower than any sequence number actually received, the entire OWAMP-Test session results MUST be invalidated. Upon Stop-Sessions, the receiver MUST discard packet records with computed send times between (current time − Timeout) and current time to ensure statistical consistency.
Packet Padding SHOULD be pseudo-random (generated independently of other pseudo-random values in the protocol). However, implementations MUST provide a configuration parameter or option allowing Packet Padding to consist of all zeros.
Stop-Sessions Number of Sessions MUST equal the count of send sessions started by the local side that have not been previously terminated: the Control-Client MUST account for each accepted Request-Session where Conf-Receiver was set; the Control-Server MUST account for each where Conf-Sender was set. A mismatch renders the message invalid and the connection SHOULD be closed.
OWAMP consists of two inter-related protocols: OWAMP-Control (layered over TCP, port 861) for initiating, controlling, and fetching measurement session results, and OWAMP-Test (layered over UDP) for exchanging singleton measurement packets. Both support unauthenticated, authenticated, and encrypted modes; all OWAMP-Test sessions inherit the mode of their controlling OWAMP-Control session.
OWAMP-Control integrity protection uses HMAC-SHA1 truncated to 128 bits (16 octets). Each HMAC covers everything transmitted in one direction since the previous HMAC. When encrypting, HMAC is computed before encryption; when decrypting, decryption precedes HMAC verification. The HMAC MUST be checked as early as possible.
OWAMP-Test session keys are derived from OWAMP-Control keys using the SID. The AES Session-key is derived by AES-ECB encrypting the OWAMP-Control AES Session-key with the 16-octet SID as key. The HMAC Session-key is derived by AES-CBC (IV=0) encrypting the 32-octet OWAMP-Control HMAC Session-key with the SID as key.
Send schedules are composed of typed slots: type 0 (exponentially distributed pseudo-random delay with specified mean) and type 1 (fixed delay). The schedule is circular; both sender and receiver independently execute the same schedule to reconstruct send times for lost packets. Seeds for type-0 slots use a specified reproducible algorithm.
IANA has assigned TCP and UDP port 861 for the OWAMP-Control protocol. This well-known port is used by Control-Clients and Fetch-Clients to establish connections to OWAMP servers.
AES MUST be included in all OWAMP implementations. The shared secret is a passphrase (MUST NOT contain newlines) from which a session key is derived using PBKDF2 (PKCS #5) with HMAC-SHA1 as the PRF. AES Session-key and HMAC Session-key MUST be generated with sufficient entropy (RFC 4086) and SHOULD be derived independently of each other.
Long-term manually managed keys create operational risks because they are never automatically rotated. Operators SHOULD use short shared secrets, rotate them frequently, and be aware that a compromised key allows session replay and timestamp forgery until the key is changed.
OWAMP test streams can serve as covert information channels because inter-packet timing and content can be modulated. Encrypted mode prevents undetectable timestamp modification by intermediaries attempting to falsify one-way delay measurements.
Third-party DoS attacks are mitigated by the challenge-response authentication mechanism, which requires proof of a shared secret before the server allocates resources for test sessions. Servers SHOULD enforce connection timeouts (approximately 30 minutes) to bound memory use from incomplete control-message exchanges.
Time MUST NOT be used as the PBKDF2 salt. Using time would allow an attacker who observes two sessions using the same passphrase to derive the same key from publicly observable data. The salt MUST be pseudo-randomly generated per-session.
OWAMP-Control has an 'active measurements' state, entered after the client sends Start-Sessions and the server acknowledges. Both sides remain in this state until each has both sent and received (in unspecified order) a Stop-Sessions command. The only command available during active measurements is Stop-Sessions.
Error Estimate is 16 bits: S-bit (1 = clock synchronized to external UTC source such as GPS or NTP), Z-bit (MBZ), 6-bit Scale (unsigned), 8-bit Multiplier (unsigned). Error in seconds = Multiplier * 2^(Scale−32). Multiplier MUST NOT be zero; a zero Multiplier means the packet SHOULD be discarded as corrupt.
Fetch-Session packet record is 25 octets: 4-octet Sequence Number, 2-octet Send Error Estimate, 2-octet Receive Error Estimate, 8-octet Send Timestamp, 8-octet Receive Timestamp, 1-octet TTL/Hop Limit. Lost packet records use presumed send time, Multiplier=1/Scale=64/S=0 error estimate, all-zero receive timestamp, and TTL=255.
OWAMP-Test packet in authenticated and encrypted modes: 4-octet Sequence Number, 12-octet MBZ, 8-octet Timestamp, 2-octet Error Estimate, 6-octet MBZ, 16-octet HMAC, variable Packet Padding. Minimum data segment length is 48 octets.
OWAMP-Test packet in unauthenticated mode: 4-octet Sequence Number, 8-octet Timestamp, 2-octet Error Estimate, variable Packet Padding. Minimum data segment length is 14 octets.
Request-Session message: 1-octet type (1), IPVN (4-bit IP version), Conf-Sender and Conf-Receiver flags (1 octet each), 4-octet Number of Schedule Slots, 4-octet Number of Packets, sender/receiver ports (2 octets each) and addresses (4 or 16 octets), 16-octet SID, 4-octet Padding Length, 8-octet Start Time, 8-octet Timeout, 4-octet Type-P Descriptor, 8-octet MBZ, 16-octet HMAC; followed by schedule slot records and a second 16-octet HMAC.
Server Greeting (64 octets): 12-octet Unused, 4-octet Modes bitmask (bit 0=unauthenticated, bit 1=authenticated, bit 2=encrypted; first 29 bits MUST be zero), 16-octet Challenge (random), 16-octet Salt (pseudo-random), 4-octet Count, 12-octet MBZ.
Server-Start message (48 octets): 15-octet MBZ, 1-octet Accept (0=OK), 16-octet Server-IV (random, unused in unauthenticated mode), 8-octet Start-Time (timestamp of server process start), 8-octet MBZ. In authenticated/encrypted mode, Start-Time is encrypted unless Accept is non-zero.
Set-Up-Response message (176 octets): 4-octet Mode (one bit set for chosen mode), 80-octet KeyID (UTF-8, zero-padded), 64-octet Token (16-octet challenge + 16-octet AES Session-key + 32-octet HMAC Session-key, AES-CBC encrypted with IV=0 using PBKDF2-derived key), 16-octet Client-IV (random, unique per session).
Stop-Sessions message: 1-octet type (3), 1-octet Accept, 2-octet MBZ, 4-octet Number of Sessions, 8-octet MBZ; followed by session description records (each with 16-octet SID, 4-octet Next Seqno, 4-octet Number of Skip Ranges, and ordered Skip Range pairs of First/Last Seqno Skipped); concluded with 16-octet HMAC. Skip Ranges MUST be in order.
Timestamp is 64 bits in NTP format (RFC 1305): first 32 bits are unsigned integer seconds elapsed since 0h on 1 January 1900; next 32 bits are the fractional part of a second.