IPv6 Performance and Diagnostic Metrics (PDM) Destination Option
Extracted elements (24)
PDM does not require time synchronization between session partners because only time differentials (deltas) computed locally are placed in packets. Each host uses its own clock exclusively, and round-trip delay is derived by arithmetic combination of the deltas, not by comparing absolute timestamps across hosts.
The base time unit for PDM is 1 attosecond (10^-18 seconds), chosen as a common unit enabling uniform scaling across all hardware timer resolutions from picoseconds to seconds. The 16-bit delta plus 8-bit scale encoding can represent time differentials from 1 attosecond up to over 3×10^55 years without time synchronization between endpoints.
This specification recommends having PDM off by default to minimize unintended exposure of timing metadata. PDM activation should be explicit and configurable per protocol, port, or IP address, giving operators fine-grained control over measurement scope.
IPv6 transition technologies (e.g., IPv6-to-IPv4 translation) that do not recognize or support the IPv6 Destination Options extension header may drop packets containing PDM rather than translating them. Some middleboxes may also drop packets when the PDM header pushes Layer 4 information beyond the depth of their filtering logic.
A limit on memory used for PDM control blocks SHOULD be implemented. Without a memory limit, an attacker can misuse control blocks to cause excessive resource consumption.
An implementation SHOULD require an explicit restart of PDM monitoring after a certain time period (e.g., after 1 hour) to ensure PDM is not accidentally left on after debugging. Additionally, user 'Consent to be Measured' SHOULD be a prerequisite for using PDM.
For each IPv6 packet header, PDM MUST NOT appear more than once. An encapsulated packet MAY contain a separate PDM associated with each encapsulated IPv6 header.
If using PDM in ESP transport mode, PDM MUST be placed after the ESP header so as not to leak information.
In the ESP case, the Security Parameter Index (SPI) numbers SHOULD be ignored when considering the flow over which PDM information is measured; the flow should be identified only by SADDR, DADDR, and PROTC.
Operating systems MUST implement a separate packet sequence number counter per 5-tuple (SADDR, SPORT, DADDR, DPORT, PROTC). PSNTP is initialized at a random number to make spoofing harder and incremented monotonically for each packet of the session flow.
PDM MUST NOT be turned on merely because a packet is received with a PDM header, as the received packet could be spoofed by another device.
The Option Length field MUST be set to 10 (octets, excluding Option Type and Option Length fields).
The position where PDM timestamps are taken SHOULD be as close to the physical network interface as possible to minimize attribution of host processing time to network latency.
The two high-order bits of the PDM Option Type field MUST be set to 00, indicating that nodes that do not recognize this option should skip and continue processing. The third high-order bit MUST be 0, indicating the Option Data does not change en route.
DELTATLR (Delta Time Last Received) is a 16-bit unsigned integer representing the server delay: the time difference between when the sender sends the current packet and when it received the previous packet (send time packet n minus receive time packet n-1). Its scale is given by SCALEDTLR.
DELTATLS (Delta Time Last Sent) is a 16-bit unsigned integer representing the elapsed time from when the last packet was sent to when the current packet is sent (receive time packet n minus send time packet n-1). Its scale is given by SCALEDTLS. Used to derive round-trip delay when combined with DELTATLR.
PSNLR (Packet Sequence Number Last Received) is a 16-bit unsigned integer initialized to 0. It carries the PSNTP value of the last packet received on the 5-tuple, enabling the receiver to correlate DELTATLR with the specific packet it received.
PSNTP (Packet Sequence Number This Packet) is a 16-bit unsigned integer initialized to a random number and incremented monotonically per session 5-tuple. It wraps and is intended for use while analyzing packet traces to correlate packets across observation points.
SCALEDTLR and SCALEDTLS are 8-bit unsigned integers (range 0–255) that store the number of low-order bits truncated from the respective 64-bit attosecond time-differential value to fit it into the 16-bit delta field. The actual time differential is: delta_value * 2^scale attoseconds.
IANA registered Destination Option Type 0x0F in the 'Destination Options and Hop-by-Hop Options' sub-registry of 'Internet Protocol Version 6 (IPv6) Parameters', with act bits 00 and chg bit 0, assigned to the Performance and Diagnostic Metrics (PDM) destination option.
PDM can enable timing attacks against cryptographic protocols: an attacker observing PDM-separated processing times may be able to extract keying material by correlating fine-grained server latency with cryptographic operations. PDM should be restricted to specific addresses or ports to limit this exposure.
PDM fields (sequence numbers and delta times) could be misused as a covert channel by a compromised end host. A PDM-aware middlebox or destination host detecting nonsensical sequence numbers or timing values could take action to block, discard, or alert on such traffic.
PDM timing data passes in the clear and can be used to fingerprint end hosts (e.g., inferring device speed from delta patterns) or potentially to infer the type of application in use by correlating server processing time with payload length. Encryption algorithms may wish to obfuscate server time in addition to packet length.
The PDM destination option is encoded in TLV format as a 12-byte structure: 1-byte Option Type (0x0F), 1-byte Option Length (must be 10), 1-byte ScaleDTLR, 1-byte ScaleDTLS, 2-byte PSNTP, 2-byte PSNLR, 2-byte DELTATLR, and 2-byte DELTATLS. Multi-octet values are aligned on natural boundaries per RFC 8200.