Multicast Ping Protocol
Extracted elements (27)
The Client Timestamp and Server Timestamp options use a 32-bit seconds-since-epoch format rather than the NTPv4 timestamp format. The document explicitly acknowledges this was the wrong choice and recommends the NTPv4 format be considered for future protocol extensions.
The default request rate of 1 per second (Default-Client-Request-Rate) was chosen because it is safe across most deployments and mirrors the conventional behavior of the ICMP 'ping' tool. The value may be less than 1 to support very low-rate environments.
Version 1 implementations (predating this specification) exist and do not include the Version option. A server receiving a message without a Version option or with a version other than 2 SHOULD respond with a Server Response setting version to 2, and a client receiving such a response MUST stop sending requests.
A client receiving a Server Response with a version other than 2 MUST stop sending requests to that server (unless it supports that version). This prevents version mismatch loops.
All messages MUST always be in network byte order. UDP checksums MUST always be used.
Clients MUST by default send at most Default-Client-Request-Rate Echo Request messages per second (RECOMMENDED value: 1). Servers MUST by default perform per-client rate limiting, responding to at most Default-Server-Rate-Limit messages per second per client (RECOMMENDED value: 1).
Echo Reply messages MUST first contain the exact options (in the same order) from the Echo Request, and then any options appended by the server. A server MUST NOT process unknown options, but MUST still echo them. A client MUST ignore any unknown options.
If a client receives a Session ID option in a Server Response message, the client MUST echo it with the exact same value in all subsequent Echo Request messages. The Session ID value SHOULD be a pseudo-random byte string that is hard to predict (per RFC 4086) and MUST be at least 4 bytes long.
If higher-than-default rates are allowed for specific client IP addresses, Init messages and the Session ID option MUST be used to help mitigate spoofing.
The Sequence Number option (type 2) MUST always be included in Echo Request messages and MUST NOT be included in Init messages. Its length MUST be 4 (32-bit integer). A server MUST copy it into the Echo Reply.
The Version option (type 0) MUST always be included in all messages; its length MUST be 1 and the value MUST be set to 2 for the current protocol version. A server receiving a message with a version other than 2 SHOULD send a Server Response with version set to 2.
Unless otherwise specified, an option MUST NOT be used multiple times in the same message. The Multicast Prefix option (type 10) is explicitly excepted and MAY be included multiple times to specify multiple prefixes.
For each Echo Request, the server sends two Echo Reply messages: one unicast to the source IP address and UDP port of the requesting client, and one multicast to the requested group G and the source UDP port. Both are sent from the same port on which the request was received.
Four message types are defined: Echo Request (type 81 / ASCII 'Q'), Echo Reply (type 65 / ASCII 'A'), Init (type 73 / ASCII 'I'), and Server Response (type 83 / ASCII 'S'). Message types 254–255 are reserved for experimental use; types 0–253 require IANA registration.
The Init / Server Response negotiation allows a client to request a multicast group address from a server before beginning Echo Request/Reply measurements. The client sends an Init with Multicast Prefix options; the server responds with a Multicast Group option and SHOULD include a Session ID.
The TTL option (type 9, length MUST be 1) specifies the TTL/hop-count used for an Echo Reply message. Servers SHOULD include this in every Echo Reply to allow clients to determine the number of router hops traversed. If absent, the client SHOULD NOT attempt to calculate hop count.
IANA assigned UDP port 9903 (multicast-ping) for this protocol and created a Multicast Ping Protocol Message Types registry (types 0–253 require Specification Required; 254–255 experimental) with initial values: 65 Echo Reply, 73 Init, 81 Echo Request, 83 Server Response.
IANA created a Multicast Ping Protocol Option Types registry (types 0–65531 require Specification Required; 65532–65535 experimental), initially populated with types 0–12 and noting types 7 and 8 as deprecated.
A host may spoof the source address of an Echo Request, causing the server to send unicast and multicast Echo Replies to the spoofed host. If the victim also happens to be joined to the multicast group, an amplification effect occurs (2× replies per request). The Session ID mechanism mitigates this by binding responses to an unpredictable token associated with the client's IP address.
Servers MUST implement default per-client rate limiting to prevent this protocol from being used in denial-of-service attacks. A leaky bucket algorithm is suggested to allow short bursts while maintaining a long-term average at or below Default-Server-Rate-Limit.
The Session ID provides only partial spoofing mitigation: an on-path attacker can eavesdrop traffic, learn a valid Session ID, and forge Echo Request messages that the server will honor until the Session ID expires. The spec acknowledges there is no stronger on-path protection in this version.
This protocol can be used to establish a covert channel: a client may embed arbitrary data in undefined options, which the server echoes in a multicast Echo Reply reaching all group members. A future mitigation suggested is to reply with a hash of the data rather than a verbatim copy.
All messages share a common format: a one-octet message Type field immediately followed by a variable number of TLV options. There is no alignment or padding between options; options may start at any octet boundary.
Each TLV option consists of a 2-octet Type, a 2-octet Length (value field length in octets, 0–65535), and a Value field of the specified length. If Length is 0 the value field is absent.
The Client Timestamp and Server Timestamp options (types 3 and 12) are each 8 bytes: the first 4 bytes are seconds since the Unix epoch (0000 UTC Jan 1, 1970), and the next 4 bytes are microseconds within that second.
The Multicast Group option (type 4) value contains a 2-octet IANA Address Family number followed by the group address. Length is 6 for IPv4 (4-byte address) and 18 for IPv6 (16-byte address).
The Multicast Prefix option (type 10) encodes: 2-octet Address Family, 1-octet Prefix Length, and a partial group address covering exactly the prefix length bits. Prefix length 0 is a wildcard (any multicast address from that family). Option value length is 3 for wildcard, 4–7 for IPv4, and 4–19 for IPv6.