Alternate-Marking Method
obsoletes
- rfc-8321 — Alternate-Marking Method for Passive and Hybrid Performance Monitoring
Extracted elements (30)
Alternate Marking avoids per-packet sequence numbers by 'coloring' packets so consecutive blocks have different colors. This eliminates the need to extract and process a sequence number from each packet in real time, which can overload devices, especially when higher-layer sequence numbers are buried inside the payload.
Single-Marking is sensitive to out-of-order reception and only yields mean delay without distribution information. Double-Marking was introduced to obtain minimum, maximum, median, and percentile delay values and to robustly identify which measurement packet was lost within a block.
The Alternate-Marking Method is classified as Hybrid Type I per RFC 7799 because the change in value of marking bits occurs at domain edges, which formally constitutes a modification of the stream of interest, even though no new packets are injected. This distinction from pure Passive measurement motivates the controlled-domain restriction.
All changes in RFC 9341 relative to RFC 8321 are fully backward compatible; no new technique has been introduced. RFC 9341 adds recommendations for one-flag versus two-flag deployments and extends description of synchronization, timing, and fragmentation handling.
NTP (RFC 5905) or IEEE 1588 PTP may be used for timestamp formats and clock synchronization depending on required precision. The Alternate-Marking Method depends on an underlying time synchronization protocol for both delay measurement validity and block boundary alignment.
The method is applicable to any packet-based traffic including Ethernet, IP, and MPLS, both point-to-point unicast and multicast. RFC 9342 generalizes the coloring and counting functions for multipoint-to-multipoint flows.
For coherent delay comparison across routers, clocks on all network nodes performing delay measurement MUST be in sync. A measurement is valid only if no packet loss occurs and packet misordering can be avoided.
Marking nodes MUST mark all fragments if flag bits are available in the encapsulation, treating each fragment as a separate packet. This applies regardless of whether fragmentation occurs at the marking node.
Measurement points SHOULD ignore unmarked fragments and count marked fragments as full packets. With sufficient resources, they MAY track both marked and unmarked initial fragments and increment the counter only if all other fragments are consistently marked or consistently unmarked.
Nodes that fragment packets within the measurement domain SHOULD, if capable, ensure that only one resulting fragment carries the marking bit(s) of the original packet, to avoid introducing errors into the measurement.
The Alternate-Marking Method MUST only be applied within controlled domains. Policies at domain boundaries must filter external marked packets entering the domain and internal marked packets leaving it.
The Block Number MUST be assigned to each measurement block and associated with each packet count and timestamp reported to or pulled by other nodes or NMSs, ensuring that matching BNs from upstream and downstream nodes confirm the same measurement block.
The flow-based measurement strategy is REQUIRED when implementing this specification. It requires identifying the flow to be monitored and discovering the path it follows; measurement is consistent only if all flows in a group follow the same path.
The synchronization accuracy condition d < L/2 MUST be satisfied, where d is the guard band and L is the block duration. Packet counters and double-marked packets MUST respectively be read and selected within the resulting available counting interval to avoid error from out-of-order effects and clock skew.
The use of a fixed timer for switching block color is REQUIRED when implementing this specification. Switching after a fixed number of packets is an additional possibility, but its detailed specification is out of scope.
When counters and timestamps are reported to nodes or an NMS, a data correlation mechanism SHOULD be in use to associate any two packet counts or timestamps with the same measurement block or marked packet.
When only one flag bit is available, packet-loss measurement MUST follow Section 3.1 and delay measurement MUST use the Single-Marking Method (Section 3.2.1). When two flag bits are available, delay measurement MUST use the Double-Marking Method (Section 3.2.2).
Privacy concerns are limited because the method only uses information in the packet header or encapsulation and does not release user data. The limited marking technique is unlikely to substantially increase existing privacy risks from header metadata, though covert-channel modulation of the marking is a theoretical concern.
A Block Number (BN) MAY be used for data correlation. When used, the BN MUST be assigned to each measurement block and associated with every packet count and timestamp reported, so that a correlator can match upstream and downstream samples to the same block.
Data collection transmits per-block counters and timestamps from measurement nodes to a correlator. Correlation may use a centralized NMS (push or poll mode) or a distributed protocol-based exchange (e.g., extensions to TWAMP or OWAMP).
Double-Marking delay methodology uses a first marking bit to create alternate blocks (for loss and mean-delay) and a second marking bit to select specific packets within each block for per-packet delay measurement. This overcomes out-of-order sensitivity and enables delay distribution statistics (percentiles, variance, median).
Single-Marking delay methodology: whenever the color changes, a measurement node timestamps the first packet of the new block. Comparing the timestamp of the same first packet at an upstream node versus a downstream node yields the one-way delay for that block.
The guard band d is defined as d = A + D_avg + 3*D_stddev, where A is the clock accuracy bound, D_avg is the average network delay, and D_stddev is its standard deviation. The available counting interval is L - 2d, which must be positive.
Traffic is divided into consecutive blocks by alternating a marking color (A or B) in a packet header flag bit. All packets in the same block share the same color; a color change signals the boundary between blocks and serves as an auto-synchronization signal for measurement points along the path.
Two measurement strategies are defined: flow-based (only a specified flow is colored; requires advance knowledge of the path) and link-based (all traffic on a link is colored; each hop must re-color the traffic because the color need not be consistent across links).
An on-path attacker can selectively induce synthetic delay to delay-colored packets, causing systematic error in delay measurements. Attacks on the underlying time synchronization protocol (see RFC 7384) can further compromise measurement integrity.
Applying Alternate Marking outside a controlled domain allows attackers to inject artificially marked packets, potentially skewing measurements. Externally marked packets MUST be filtered or cleared at domain ingress boundaries; nodes outside the domain should ignore marked packets.
Channels used to report flow statistics between monitoring points and the NMS MUST be secured, as attacks on data collection and reporting can interfere with proper measurement system functioning.
It is theoretically possible to modulate the marking bit pattern to serve as a covert channel for an on-path observer, though this would have a very low data rate if it is to avoid adversely affecting measurement systems that monitor the marking. The controlled-domain constraint limits exposure.
Routers or other on-path devices could intentionally alter marking bits to corrupt measurements. Because the method is confined to a controlled domain with locally administered nodes, such insider attacks can be operationally detected and prevented.