Mechanisms for MPLS Ping and Traceroute Procedures in Inter-Domain Segment Routing Networks
Extracted elements (28)
Dynamic return path building (Section 5.5) was introduced because head-end nodes may not have complete visibility of inter-AS/inter-domain topology. Domain border nodes (ABRs, ASBRs) dynamically construct and insert their Node-SID and EPE-SID into the Reply Path TLV, enabling traceroute without full topology knowledge at the head-end.
The mechanism uses MPLS data plane forwarding for echo replies so that any MPLS-capable node can forward echo reply packets in the fast path without changes to the forwarding plane. This is preferred over RFC 7743's relay-based solution, which requires slow-path or bump-in-the-wire processing at every relay node.
When the SRGB is not uniform across the network, it is RECOMMENDED to add Type-C or Type-D segments (carrying node IP addresses) rather than Type-A (label-only) segments, because downstream nodes may not know the SRGB of a remote domain needed to translate an IP address to a label.
Handling end-to-end MPLS OAM for networks consisting of mixed IPv4-only and IPv6-only domains is out of scope. Dual-stack deployment is recommended, using end-to-end IPv6 addresses for MPLS ping and traceroute procedures in such environments.
The document reuses sub-TLV code points from the registry common to TLVs 1, 16, and 21, but defines Type-A, Type-C, and Type-D sub-TLV usage only for TLV 21 (Reply Path TLV). If these sub-TLVs appear in TLV 1 or 16, error codes per RFC 8029 MUST be returned, preventing misuse in other LSP ping contexts.
An ASBR that receives an echo request from a neighbor in the same AS MUST look at the Reply Path TLV; if it contains a Type-C/Type-D segment, it MUST convert it to a Type-A segment by deriving a label from its own SRGB, and MUST set the Reply Path Return Code to 0x0006.
If the optional MPLS SID is present in Type-C/Type-D segments, the node sending the echo reply MUST use the SID to encode the echo reply with MPLS labels. If the MPLS SID does not match the IPv4 or IPv6 address field, log information should be generated.
If the Reply Path Return Code is 'Use Reply Path TLV from this echo reply for building the next echo request' (0x0006), the Reply Path TLV from the echo reply MUST be sent in the next echo request with the TTL incremented by 1. If the TTL is already 255, the traceroute procedure MUST be ended with an appropriate log message.
If the responder does not support Reply Mode 5 or the echo request contains a malformed Segment sub-TLV (e.g., incorrect length field), an echo reply MUST be sent with Return Code set to 'Malformed echo request received' and Subcode set to zero.
If these Segment sub-TLVs (Type-A, Type-C, Type-D) appear in TLVs 1 or 16 (rather than TLV 21), appropriate error codes MUST be returned as defined in RFC 8029.
The first segment in the Reply Path TLV MUST correspond to the top segment in the MPLS header that the responder MUST use while sending the echo reply.
The LSP ping initiator MUST set the Reply Mode of the echo request to 5 (Reply via Specified Path), and a Reply Path TLV MUST be carried in the echo request message correspondingly. The Reply Path TLV MUST contain the SR Path in the reverse direction encoded as an ordered list of segments.
The top label of the echo reply MUST be constructed from the first segment of the Reply Path TLV, remaining labels MUST follow Reply Path TLV segment order, and the MPLS header MUST NOT add any other label.
When a Reply Path TLV is received, the responder that supports processing it MUST use the segments in the Reply Path TLV to build the echo reply. The responder MUST follow normal FEC validation procedures as described in RFC 8029 and RFC 8287.
When an ASBR is configured to build the return path dynamically, it MUST set the Reply Path Return Code to 0x0006 in the echo reply. If the ASBR's local policy prohibits dynamic return path building, it MUST set the Return Code to 0x0007.
The A-Flag in the Segment Flags field indicates the presence of an SR Algorithm ID in the SR Algorithm field, applicable to Type-C and Type-D segment types. If the A-Flag appears with Type-A, it MUST be ignored. Unused flag bits MUST be set to zero on transmission and MUST be ignored on receipt.
The Reply Path TLV (from RFC 7110) is used with Reply Mode 5 to carry the SR return path as an ordered list of Segment sub-TLVs. This document defines three new sub-TLVs (Type-A, Type-C, Type-D) for encoding SR label stacks within the Reply Path TLV.
Type-A Segment sub-TLV encodes a single SID in the form of an MPLS label. It carries a 20-bit Label value, 3-bit TC, 1-bit S (reserved, must be zero), and 1-octet TTL. If the originator wants the receiver to choose TC, it MUST set TC to zero; if it wants the receiver to choose TTL, it MUST set TTL to 255.
Type-C Segment sub-TLV encodes an IPv4 Node Address (mandatory, 4 octets), SR Algorithm (1 octet, used when A-Flag is set), and an optional SID (4 octets). When the SID field is present, it MUST be used for constructing the Reply Path.
Type-D Segment sub-TLV encodes an IPv6 Node Address (mandatory, 16 octets), SR Algorithm (1 octet, used when A-Flag is set), and an optional SID (4 octets). When the SID field is present, it MUST be used for constructing the Reply Path.
IANA assigned three new sub-TLVs from the 'Sub-TLVs for TLV Types 1, 16, and 21' registry under the MPLS LSPs Ping Parameters group: sub-type 46 (SID only, MPLS label), 47 (IPv4 Node Address with optional SID for SR-MPLS), and 48 (IPv6 Node Address with optional SID for SR-MPLS).
IANA assigned two new Reply Path Return Codes in the 'Reply Path Return Codes' registry: 0x0006 ('Use Reply Path TLV from this echo reply for building the next echo request') and 0x0007 ('Local policy does not allow dynamic return path building').
IANA created a new 'Segment ID Sub-TLV Flags' registry under the MPLS LSPs Ping Parameters group, tracking 8 flags (bits 0–7, most significant first). Initial entry: Bit 1 = A-Flag. New entries require Standards Action.
It is RECOMMENDED that operators deploy security mechanisms such as MACsec (IEEE 802.1AE) on inter-domain links or security-vulnerable links to prevent spoofing attacks. Appropriate filter policies SHOULD be applied at edges, and devices MUST have mechanisms to prevent denial-of-service attacks.
The described procedures may be used by an attacker to extract a domain's internal information (e.g., topology, SIDs). An operator MUST deploy appropriate filter policies as described in RFC 8029 to restrict LSP ping and traceroute packets based on origin.
Type-A Segment sub-TLV: Type=46 (2 octets), Length=8 (2 octets, excludes Type/Length), Flags (1 octet), RESERVED (3 octets, MBZ), Label (20 bits), TC (3 bits), S (1 bit, reserved/zero), TTL (1 octet). Total payload: 8 octets.
Type-C Segment sub-TLV: Type=47 (2 octets), Length=8 (without SID) or 12 (with SID) octets, Flags (1 octet), RESERVED (2 octets, MBZ), SR Algorithm (1 octet), IPv4 Node Address (4 octets), optional SID (4 octets).
Type-D Segment sub-TLV: Type=48 (2 octets), Length=20 (without SID) or 24 (with SID) octets, Flags (1 octet), RESERVED (2 octets, MBZ), SR Algorithm (1 octet), IPv6 Node Address (16 octets), optional SID (4 octets).