Label Switched Path (LSP) Self-Ping
Extracted elements (20)
A timer-based approach (delay traffic forwarding after RESV receipt) was rejected because no single timer value is optimal: too short prevents neither black-holing, too long slows setup. The optimum is network-wide and changes with topology, making it a moving target.
LSP Ping was rejected as a readiness-verification mechanism because it sends MPLS Echo Requests to the egress LSR's control plane, imposing control-plane overhead that the egress cannot bound. During convergence events affecting large numbers of LSPs, this overhead is prohibitive. LSP Self-ping requires only that the egress data plane forward an ordinary IP packet.
LSP Self-ping is intentionally not a general-purpose OAM mechanism. Its primary design constraint is minimal impact on egress LSR performance, trading off the ability to detect incorrect forwarding state for extremely low overhead during large-scale convergence events.
When RSVP-TE optimizations allow LSRs to send RESV messages before installing forwarding state, a race condition arises: the ingress LSR may forward traffic through an LSP before all downstream nodes have installed forwarding state, causing traffic loss. LSP Self-ping was created specifically to close this gap by confirming end-to-end forwarding state installation.
LSP Self-ping cannot reliably verify the correctness of downstream forwarding state. If a downstream LSR installs state that terminates the LSP at the wrong node, or if a downstream LSR forwards a packet without an MPLS label, LSP Self-ping will not detect the error.
LSP Self-ping fails when Reverse Path Forwarding (RPF) filters are enabled on links connecting the ingress LSR to the egress LSR, because the returning UDP packet will be dropped by RPF.
LSP Self-ping fails when the LSP under test is signaled by LDP Independent Mode (RFC 5036), because the forwarding state installation sequence differs from RSVP-TE.
The LSP Self-ping message may arrive at the egress LSR with or without an MPLS header depending on whether penultimate hop popping is in effect; the egress removes any residual MPLS header and then forwards the inner IP packet normally back toward the ingress.
For bidirectional LSPs, neither the active side nor the passive side MUST forward traffic through the LSP until its local LSP Self-ping session returns TRUE. Each side runs an independent session and may begin forwarding as soon as its own session succeeds, without waiting for the other side.
If the RSVP messages establishing the LSP were delivered over IPv4, the LSP Self-ping UDP datagram MUST be encapsulated in an IPv4 header; if over IPv6, it MUST be encapsulated in an IPv6 header.
The IP Source Address of the LSP Self-ping message MAY be configurable, but by default it MUST be the address of the egress LSR. The IP Destination Address MUST be the address of the ingress LSR.
The IP TTL/Hop Count MAY be configurable; by default it MUST be 255. The IP DSCP MAY be configurable; by default it MUST be CS6 (110000) per RFC 4594.
The UDP Source Port MUST be selected from the dynamic range (49152–65535) per RFC 6335. The UDP Destination Port MUST be lsp-self-ping (8503).
When an LSP Self-ping session terminates, it MUST return its completion status to the invoking protocol (e.g., RSVP-TE), allowing the caller to decide whether to begin forwarding traffic.
An LSP Self-ping session is a short-lived, ingress-local state object comprising: a 64-bit Session-ID, a Retry Counter (max probe attempts, configurable), a Retry Timer (milliseconds between probes, configurable with optional back-off), and a boolean Status (initially FALSE, set TRUE on echo return).
IANA has assigned UDP Port Number 8503 (service name lsp-self-ping) for use by MPLS LSP Self-Ping, recorded in the Service Name and Transport Protocol Port Number Registry.
LSP Self-ping messages are easily forged, allowing an attacker to send a forged message to the ingress LSR and cause premature termination of the LSP Self-ping session. Operators SHOULD filter LSP Self-ping packets at the edges of the MPLS signaling domain to mitigate this threat.
To prevent an attacker from guessing valid Session-IDs and forging returns, implementations SHOULD NOT assign Session-IDs in a predictable manner. A Cryptographically Secure Pseudorandom Number Generator (CSPRNG) per NIST SP 800-90A is recommended for Session-ID generation.
The ingress LSR loops: format and send an LSP Self-ping message through the LSP under test, then wait Retry Timer milliseconds. If the corresponding message returns, set Status to TRUE (session succeeds). Otherwise, decrement Retry Counter and optionally increase Retry Timer via back-off. The loop terminates when Status is TRUE or Retry Counter reaches zero.
The LSP Self-ping message payload is a single 64-bit Session-ID field carried in a UDP datagram. The Session-ID associates the message with a specific LSP Self-ping session on the ingress LSR.