Clustered Alternate-Marking Method
obsoletes
- rfc-8889 — Multipoint Alternate-Marking Method for Passive and Hybrid Performance Monitoring
Extracted elements (24)
Four deployment options exist — one flag, two flags, one flag with hashing — governed by: (1) number of flag bits available in the packet header, (2) required temporal sampling frequency constrained by timing requirements, (3) whether per-path or per-packet granularity is needed, and (4) available computational resources (mean delay requires more processing).
The method is restricted to unicast flows (including anycast and ECMP) and explicitly excludes BUM (Broadcast, Unknown Unicast, Multicast) traffic, because traffic replication is not covered by the Multipoint Alternate-Marking Method. BUM traffic can be handled link-by-link using the basic RFC 9341 method.
The scope of Multipoint Alternate Marking differs from RFC 5644 (which covers active one-to-group spatial metrics with a single source). This document defines group-to-group passive and hybrid measurements where multiparty metrics apply to clusters as spatial segments of a multipoint path, extending RFC 5644's metric names to the group-to-group topology.
Without network clustering, Alternate Marking can only be applied to the entire network or per single flow. Network clustering allows partitioning the network into clusters at different levels, enabling flexible and optimized performance measurement. This reduces the order of magnitude of packet counters from n*m*2 (for n measurement points and m flows) to a much smaller set.
Clustered Alternate Marking is fully backward compatible with RFC 8889 (which it obsoletes). All changes are non-breaking: added deployment recommendations for one vs. two flag bits, improved readability, and revised timing/synchronization descriptions — no new techniques were introduced.
In cases of translation or encapsulation traversed by a monitored flow, cluster properties (packet-in equals packet-out invariant) must also be invariant across the translation/encapsulation boundary.
The Clustered Alternate-Marking Method applies only to unicast flows (multipoint-to-multipoint, anycast, ECMP). For BUM traffic, RFC 9341's basic method applies link by link. Fragmented packets are handled per the guidance in Section 6 of RFC 9341.
In a multipoint-to-multipoint network, the multiple sources MUST mark the traffic coherently and MUST be synchronized with all other nodes according to the timing requirements detailed in Section 8.
The Multipoint Alternate-Marking Method MUST only be applied to controlled domains, as per RFC 9341.
When one flag with hash-based selection is used: packet-loss measurement MUST use network clustering; hash-based selection methodologies MUST be used for delay measurement.
When only one flag bit is available: packet-loss measurement MUST be done using the network clustering partition (Section 6/5), and delay measurement MUST be done according to mean delay calculation representative of the multipoint path (Section 7.1.1). Single-Marking based on first/last packet cannot be applied.
When two flag bits are available: packet-loss measurement MUST be done using network clustering; delay measurement SHOULD be done on a single-packet basis using the Double-Marking Method. The mean delay calculation MAY also be used as a representative value of a multipoint path.
A cluster is defined as the smallest identifiable non-trivial subnetwork of the entire monitoring network graph where the number of packets entering equals the number exiting (in the absence of packet loss). A cluster must contain all arcs emanating from its input nodes and all arcs terminating at its output nodes.
Clustered Alternate Marking (Multipoint Alternate Marking) extends the Alternate-Marking Method of RFC 9341 to multipoint-to-multipoint unicast flows, anycast, and ECMP flows. The methodology splits packet flows into marking blocks and uses packet counters and timestamps per marking period.
In a multisource multipoint path, the measurement interval is defined by the marking node most aligned with the start of measurement (earliest clock). Egress nodes receive alternately marked packets in random order from different ingress nodes, which must not affect the measurement result.
Mean delay for multipoint paths is measured as the difference between the weighted averages of mean timestamps at output and input nodes, with timestamps weighted by the number of packets at each endpoint. Two-way delay of a multipoint path can be computed by summing one-way delays of both directions.
Network packet loss for a multipoint flow is computed as PL = (PI1 + PI2 + ... + PIn) - (PO1 + PO2 + ... + POm), where PIi is the packet count at the i-th input node and POj is the count at the j-th output node, applied per Alternate-Marking period and per flow.
Single-packet-basis delay measurements face limitations in multipoint scenarios: Single Marking based on first/last packet of the interval does not work because it is impossible to correlate which path the first packet takes in point-to-multipoint scenarios. Double Marking works only statistically and can only measure a single path per marking period.
The closed-loop 'network zooming' approach allows an SDN controller or NMS to start with coarse cluster measurements and progressively refine by either (1) changing traffic filters to select more detailed flows or (2) activating new measurement points with more specified clusters, down to per-flow point-to-point analysis when a problem is localized.
The guard band formula d = A + D_avg + 3*D_stddev (where A is clock accuracy, D_avg is average network delay, D_stddev is standard deviation of delay) applies to each measurement point on the multipoint path. The available counting interval L - 2d must be > 0 for the method to function correctly.
The Hashing Selection Method (Mixed Hashed Marking) combines Single Marking with hash-based packet selection (per RFC 5474/5475) to enable delay measurements across all paths of a multipoint flow simultaneously in the same marking period. Alternate-Marking periods serve as temporal anchors for hashing samples, and dynamic hash length adaptation can bound samples per period.
The monitoring network is modeled as a set of nodes (measurement points, MPs) and directed arcs (connections between MPs). Only measurement points and links where traffic has flowed need to be represented in the graph. Each monitoring point maintains a packet counter per marking period for the monitored flow.
The two-step cluster partition algorithm: (1) group links sharing the same starting node; (2) join groups that share at least one common ending node. Each resulting set of links with its endpoint nodes constitutes a cluster. The algorithm is applied per direction since a node cannot be both source and destination.
This document specifies a measurement methodology that does not directly affect Internet security or applications. However, implementations must be mindful of the security and privacy concerns explained in RFC 9341, including the requirement to apply the method only within controlled domains.