Well-Known Port Assignments for the One-Way Active Measurement Protocol (OWAMP) and the Two-Way Active Measurement Protocol (TWAMP)
updates
Extracted elements (18)
TWAMP Light was relegated to an informative appendix in RFC 5357 because it lacked specifications for negotiating which variant of TWAMP would be used (raised by Lars Eggert AD review) and lacked mandatory-to-implement security features — specifically, the key for authenticated/encrypted modes depended on the TWAMP-Control session key (raised by Tim Polk ballot discuss).
UDP ports 861 and 862 were originally assigned to the OWAMP/TWAMP control protocols, but control protocols require TCP and cannot use UDP. The ports were reassigned to the test protocols (OWAMP-Test, TWAMP-Test) which actually operate over UDP, making the well-known port assignments useful.
Deployment of the allocated TWAMP-Test Receiver Port (862/UDP) is backward compatible with existing TWAMP-Control implementations based on RFC 5357. A server that does not support the allocated port returns an alternate port number in Accept-Session with Accept field = 0.
When measuring performance in an ECMP network, OWAMP-Test/TWAMP-Test can monitor different paths by varying only one of the five-tuple parameters (e.g., source port number). Using the reallocated well-known UDP port as the Receiver Port does not negatively impact concurrent ECMP path monitoring since port use is optional.
A TWAMP Control-Client that supports the allocated TWAMP-Test Receiver Port MAY request that port number in the Request-TW-Session command. If the Server does not support it, the Server sends an alternate port in Accept-Session with Accept field = 0.
An OWAMP-Control client that supports the allocated OWAMP-Test Receiver Port MAY request that port in the Request-Session command. If the Server does not support it or the port is unavailable, the Server sends an alternate port in Accept-Session with Accept field = 0.
If a TWAMP Server cannot use the proposed Receiver Port, it MAY suggest an alternate available port in the Port field of the Accept-Session message. If rejecting a session for other reasons, the Server MUST NOT suggest an alternate port and the Port field MUST be set to zero.
Implementation of both OWAMP-Control and OWAMP-Test is REQUIRED for Standards Track OWAMP as specified in RFC 4656. The word 'consists' in the original specification mandates both sub-protocols.
Implementation of both TWAMP-Control and TWAMP-Test is REQUIRED for Standards Track TWAMP as specified in RFC 5357. The word 'consists' in the original specification mandates both sub-protocols.
The use of the reassigned well-known UDP ports (861 for OWAMP-Test, 862 for TWAMP-Test) is OPTIONAL in Standards Track OWAMP and TWAMP implementations.
Active measurement techniques within the scope of OWAMP/TWAMP greatly reduce the sensitive information available to potential observers compared to passive observation of user traffic. For broader privacy considerations covering both active and passive techniques, the LMAP framework (RFC 7594) is referenced.
OWAMP consists of two inter-related sub-protocols: OWAMP-Control (defined in RFC 4656 Section 3) using TCP for reliable transport and security/key negotiation, and OWAMP-Test (defined in RFC 4656 Section 4) using UDP for measurement packets.
TWAMP consists of two inter-related sub-protocols: TWAMP-Control (defined in RFC 5357 Section 3) using TCP, and TWAMP-Test (defined in RFC 5357 Section 4) using UDP. TWAMP Light (Appendix I of RFC 5357) combines an unspecified control protocol with TWAMP-Test and is not Standards Track.
TWAMP-Control (TCP) negotiates the Receiver Port number for TWAMP-Test (UDP) sessions. The Control-Client proposes a port from the Dynamic Ports range; the Session-Reflector sends and receives TWAMP-Test packets on that same UDP port.
IANA reassigned UDP port 861 from owamp-control to owamp-test (OWAMP-Test Receiver Port, RFC 8545), and UDP port 862 from twamp-control to twamp-test (TWAMP-Test Receiver Port, RFC 8545). TCP assignments for ports 861 and 862 remain unchanged. Assignee updated to IESG and Contact to IETF Chair.
A MITM attacker may attempt to modify OWAMP-Test/TWAMP-Test packet contents to alter measurement results. Implementations can use authenticated mode to detect data modification and encrypted mode to prevent eavesdropping and undetected modification.
The registered well-known UDP port for OWAMP-Test/TWAMP-Test could become a target for denial-of-service (DoS) attacks or aid man-in-the-middle (MITM) attacks. Recommended mitigations include filtering access to the Receiver Port via an access list and using a non-globally routable IP address for the Session-Reflector.
There is a risk that a network under test may give special treatment to flows involving the well-known UDP port (with or without knowing measurement system addresses), thereby biasing measurement results through preferential or detrimental processing.