Bootstrap Router (BSR) Mechanism for Protocol Independent Multicast (PIM)
obsoletes
- rfc-2362 — Protocol Independent Multicast-Sparse Mode (PIM-SM): Protocol Specification
updated by
- rfc-8736 — PIM Message Type Space Extension and Reserved Bits
- rfc-9436 — PIM Message Type Space Extension and Reserved Bits
updates
- rfc-4601 — Protocol Independent Multicast - Sparse Mode (PIM-SM): Protocol Specification (Revised)
Extracted elements (29)
Bootstrap messages are forwarded out of the interface they were received on (as well as other interfaces) because routers on a LAN may have inconsistent RPF information. For example, if RPF(BSR) at router C points to router B rather than the originating router A, C will only accept the BSM when B re-forwards it onto the LAN.
Semantic fragmentation is preferred over IP fragmentation for large Bootstrap messages because loss of a single IP fragment destroys only the semantic fragment it belongs to, not the entire BSM. Group ranges whose semantic fragment is lost retain their previous RP-Set until the next BSM cycle.
For backwards compatibility with RFC 2362, the BSR SHOULD treat a C-RP-Adv message containing no group ranges as though it carried the single group range ff00::/8 (IPv6) or 224/4 (IPv4), accepting it only if the router is the elected non-scoped BSR.
Routers that implement only RFC 2362 (the original BSR) or non-scoped BSR cannot participate within admin-scope zones, because they only support one BSR per domain and cannot store RP-Sets for multiple scope zones simultaneously.
A Bootstrap message MUST be silently dropped if it did not arrive from a directly connected neighbor for which active Hello state exists, or if it was not sent to ALL-PIM-ROUTERS and is not a valid unicast BSM on startup, or if it arrived on an interface that is an admin-scope border for the first group address in the message.
A C-RP MUST NOT send a C-RP-Advertisement message with no group ranges. If the algorithm determines there are no group ranges to advertise for a particular scope zone, no C-RP-Adv message MUST be sent to that BSR.
For a scoped IPv6 Bootstrap message, if the mask length of the first group range is less than 16, the message MUST be dropped and a warning SHOULD be logged.
For IPv6, the mask length of all group ranges in a C-RP-Adv message sent to a scoped BSR MUST be >= 16.
If the BSR learns of both BIDIR and PIM-SM Candidate-RPs for the same group range, it MUST only include RPs for one protocol in Bootstrap messages. The default behavior SHOULD be to prefer BIDIR.
Routers that support only PIM-SM or only BIDIR-PIM MUST NOT ignore RP-Set ranges designated for the unsupported protocol, and MUST NOT treat those ranges as being for the protocol they support.
The RP-Holdtime field in a BSM MUST be larger than BS_Period and SHOULD be larger than 2.5 times BS_Period to allow for Bootstrap message loss. The exception is a holdtime of zero, used to immediately withdraw mappings.
There MUST be a minimum interval of BS_Min_Interval (default 10 s) between successive originated Bootstrap messages, even when the RP-Set changes.
When a new BSR is elected, a C-RP MUST send one to three C-RP-Advertisement messages (each preceded by a randomized C_RP_Adv_Backoff delay) so the new BSR learns active RPs quickly despite possible packet loss during the transition.
Administrative scoping is supported by running a separate copy of the BSR mechanism within each admin-scope zone. Scoped BSMs carry the scope identity in the first group range (Admin Scope Zone bit set) and are not forwarded by Zone Border Routers (ZBRs) across the scope boundary.
Each group-to-RP mapping in the RP-Set contains: multicast group range (address and prefix length), RP priority, RP address, hash mask length, and an SM/BIDIR flag. Multiple mappings may cover the same group; routers apply a deterministic algorithm from the routing protocol to select one RP.
Five timers govern BSR operation: Bootstrap Timer BST(Z) (BS_Period=60 s, BS_Timeout=130 s, BS_Min_Interval=10 s, BS_Rand_Override=5–23 s computed from BSR weight difference); Scope-Zone Expiry Timer SZT(Z) (SZ_Timeout=1300 s); Group-to-C-RP Expiry Timer CGET; Group-to-RP Expiry Timer GET; and C-RP Advertisement Timer CRPT (C_RP_Adv_Period=60 s, C_RP_Adv_Backoff=0–3 s).
No-Forward Bootstrap messages (No-Forward bit set) are sent to new or rebooting neighbors by the Designated Router to deliver the current RP-Set quickly. The RPF check is skipped for No-Forward BSMs. These messages are only accepted at startup before any previous BSM for the scope has been accepted and within BS_Period of startup.
Semantic fragmentation allows a single Bootstrap message to be split across multiple PIM Bootstrap Message Fragments (BSMFs), each a separate IP datagram with the same Fragment Tag. All fragments must have identical Type, No-Forward bit, Fragment Tag, Hash Mask Len, BSR Priority, and BSR Address. A receiver must collect all Frag RP Cnt RP addresses for a group range before updating that range.
The BSR election uses a weight metric defined as the concatenation of the BSR Priority field (most-significant bits) and the BSR IP address (least-significant bits), treated as a fixed-precision unsigned integer. A C-BSR that hears a higher-weight C-BSR suppresses its own Bootstrap messages.
The BSR weight formula BS_Rand_Override = 5 + priorityDelay + addrDelay provides a randomized back-off during election; high-weight C-BSRs generate small values (become elected faster) and low-weight C-BSRs generate larger delays (up to 23 s), reducing election thrashing without a hard lock-step.
BSR threats include DoS attacks (advertising bogus RPs to prevent traffic delivery) and traffic-diversion attacks (registering malicious RPs to redirect multicast streams for monitoring or man-in-the-middle interception). An attacker can also flood third parties by specifying them as RPs.
Implementations SHOULD allow restriction of which IP addresses and group ranges the BSR accepts C-RP-Advertisement messages from, via access lists. This limits the ability of rogue routers to inject unauthorized Candidate-RP entries into the RP-Set.
Implementations SHOULD provide a per-interface option to suppress sending and accepting Bootstrap messages. This should be enabled on all PIM Multicast Border Routers (PMBRs) and leaf interfaces to prevent cross-domain BSR attacks and receipt of conflicting BSR information from neighboring domains.
Unicast Bootstrap messages are accepted only during a brief window after reboot, during which a spoofed unicast BSM from an off-domain attacker (using a neighbor's source address) could be accepted. Mitigation is border/leaf interface filtering and PMBR source-address filtering for infrastructure addresses.
A Candidate-BSR operates a per-scope-zone state machine with three states: Candidate-BSR (C-BSR, another router is preferred), Pending-BSR (P-BSR, no preferred BSR exists but this router is not yet elected — prevents thrashing), and Elected-BSR (E-BSR, this router is the active BSR). Transitions are triggered by receiving preferred/non-preferred BSMs and Bootstrap Timer expiry.
Non-Candidate-BSR routers operate a per-scope-zone state machine with states: NoInfo (no knowledge of scope), Accept Any (AA, accepts any BSM as authoritative), and Accept Preferred (AP, only accepts BSMs from the current BSR or a higher-weight BSR). Transitions are driven by BSM receipt and Bootstrap Timer or Scope-Zone Expiry Timer expiry.
The Bootstrap message format includes: a 2-byte Fragment Tag, 1-byte Hash Mask Len, 1-byte BSR Priority, a variable-length BSR Address in Encoded-Unicast format, followed by repeating Group Address (Encoded-Group), RP Count (1 byte), Frag RP Cnt (1 byte), and per-RP records each containing an Encoded-Unicast RP Address, 2-byte Holdtime, 1-byte Priority, and 1 reserved byte.
The Candidate-RP-Advertisement message format includes: 1-byte Prefix Count, 1-byte Priority (lower = higher priority), 2-byte Holdtime, a variable-length RP Address in Encoded-Unicast format, and n Group Addresses in Encoded-Group format. PIM message type value is 8.
The Encoded-Group address format contains: Addr Family (1 byte), Encoding Type (1 byte), BIDIR bit [B], Reserved (5 bits), Admin Scope Zone bit [Z], Mask Len (1 byte), and Group multicast Address. The [Z] bit marks administratively scoped ranges; the [B] bit marks BIDIR-capable group ranges.