In Situ Operations, Administration, and Maintenance (IOAM) Loopback and Active Flags
Extracted elements (25)
If an IOAM looped-back packet reaches an IOAM boundary node that is not the originating node, the IOAM encapsulation is removed and the packet terminated (since it has no payload), preventing IOAM information from leaking outside the IOAM-Domain regardless of whether the node recognizes the loopback origin.
Loopback is intended to provide an accelerated alternative to Traceroute, allowing the encapsulating node to receive per-hop data from multiple transit nodes in less than one round-trip time by sending a single packet rather than multiple sequential probes.
Only a single data field per hop (Hop_Lim and node_id) is permitted in loopback packets to minimize the impact of amplification attacks, since each loopback copy itself traverses the return path and could be further processed.
The Active flag is intended to simplify decapsulating node implementation by providing an explicit signal that a packet should be terminated rather than forwarded. It is not intended as a replacement for existing active OAM protocols operating at higher layers.
If an encapsulating node receives a looped-back packet that was not originated from the current encapsulating node (Node ID mismatch), the packet MUST be dropped, ensuring that loopback cannot be exploited across IOAM-Domain boundaries.
Loopback is only applicable in IOAM encapsulations in which the identity of the encapsulating node is available in the encapsulation header. If IOAM is used over an encapsulation that does not include the encapsulating node's address, the transit or decapsulating node must not loop back a copy.
A transit node that receives a packet with the Loopback flag set but with an IOAM-Trace-Type that is not '1' in the most significant bit and '0' in the rest MUST NOT loop back a copy of the packet.
An IOAM-Domain in which the Loopback flag is used MUST be configured such that a return path from each IOAM transit and decapsulating node is expected. If no return path exists or the encapsulating node's identity is not available in the encapsulation header, configuration MUST NOT enable the Loopback flag.
An IOAM encapsulating node that supports the Loopback flag MUST support the ability to incorporate the Loopback flag selectively into a subset of forwarded packets, to prevent excessive looped-back traffic from overloading the network.
An IOAM node that supports reception and processing of the Loopback flag MUST support the ability to limit the rate of looped-back packets. The looped-back data rate SHOULD NOT exceed 1/N of interface capacity, with N>100 RECOMMENDED.
An IOAM trace option with the Loopback flag set MUST have the value '1' in the most significant bit of IOAM-Trace-Type and '0' in all remaining bits, ensuring that each transit node adds only the Hop_Lim and node_id data field.
IOAM encapsulating nodes MUST NOT push an IOAM encapsulation with the Loopback flag onto data packets that already include an IOAM encapsulation, preventing loopback nesting across nested IOAM-Domains.
It MUST be possible to use each of the Loopback and Active mechanisms on a subset of the data traffic. An encapsulating node must be able to set these flags selectively, accounting for the effect on network performance.
The L-bit MUST be cleared in the copy of the packet that a node sends back towards the source, ensuring that looped-back packets do not trigger further loopback at nodes on the return path.
The rate of traffic that includes the Active flag SHOULD NOT exceed 1/N of the interface capacity on any IOAM node's interfaces, with N>100 RECOMMENDED, to avoid overloading the network or the IOAM node processing active measurement packets.
The subset of traffic forwarded with a Loopback flag SHOULD NOT exceed 1/N of the interface capacity on any IOAM encapsulating node interface. Using N>100 as the default is RECOMMENDED in the absence of explicit operator configuration or prior topology knowledge.
Bit 1, the Loopback flag (L-bit), is defined in the IOAM Pre-allocated and Incremental Trace option headers. When set, it triggers each transit device along the path to send a truncated copy of the packet back towards the IOAM encapsulating node.
Bit 2, the Active flag (A-bit), is defined in the IOAM Pre-allocated and Incremental Trace option headers. When set, it indicates the packet is an active measurement packet (probe or replicated data) rather than a live data packet, and the decapsulating node must terminate it.
Three use cases for the Active flag are defined: (1) endpoint active measurement where the flag is not used; (2) IOAM probe packets generated by the encapsulating node with the Active flag set, terminated by the decapsulating node; and (3) replicated data packets with the Active flag set, terminated by the decapsulating node.
When processing a loopback copy, the transit node uses the source address of the original packet as the destination address of the copy, truncates any payload after the IOAM option(s), and clears the L-bit before sending the copy back. The original packet continues toward its destination unchanged.
IANA has allocated two bits in the 'IOAM Trace-Flags' registry: Bit 1 as 'Loopback' (L-bit) and Bit 2 as 'Active' (A-bit), with RFC 9322 as the reference. Bit 0 (most significant) was previously allocated by RFC 9197 as the Overflow bit.
An attacker setting the Active flag on en route packets can cause those packets to be terminated by the decapsulating device, preventing them from reaching their destination. An attacker can also trigger amplification by inducing transit switches to replicate more packets than intended.
An attacker setting the Loopback flag in synthetic or transit packets can cause amplification: each device along the path creates and returns a copy, potentially enabling a DDoS attack where multiple devices send looped-back copies to a single victim. Mitigation requires rate limiting at encapsulating and transit nodes as specified in Sections 4.1.1 and 4.2.
Nested IOAM-Domains amplify the risk of Loopback-based attacks: a looped-back copy in an outer IOAM-Domain may traverse an inner IOAM-Domain and be subject to loopback there as well, causing amplification worse than in a single-domain scenario. IOAM nodes MUST NOT push a Loopback-flagged encapsulation onto packets already carrying IOAM encapsulation.
Loopback packet termination: the encapsulating node checks the Node ID in the Hop_Lim/node_id field of the first hop. If the Node ID and IOAM-Namespace match the current node, the packet is identified as a looped-back packet and processed as such; otherwise it is treated as a conventional IOAM-encapsulated packet and decapsulated normally.