| Internet-Draft | STAMP in MPLS Networks | August 2026 |
| Gandhi, et al. | Expires 22 February 2027 | [Page] |
This document describes the procedure for encapsulating the Simple Two-Way Active Measurement Protocol (STAMP), defined in RFC 8762, and its optional extensions defined in RFC 8972, in MPLS networks. Label Switched Paths (LSPs) and Pseudowires (PWs) are used in MPLS networks for various services, including Layer 2 and Layer 3 data packets, and may use the Control Word (CW). The procedure for encapsulating STAMP test packets with or without the CW and/or an IP/UDP header for LSPs and PWs is also described.¶
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶
This Internet-Draft will expire on 22 February 2027.¶
Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶
The Simple Two-Way Active Measurement Protocol (STAMP) provides capabilities for measuring various metrics in IP networks [RFC8762] without the use of a control channel to pre-signal session parameters. [RFC8972] defines optional extensions for STAMP.¶
Label Switched Paths (LSPs) are used in MPLS networks for various services, including Layer 2 and Layer 3 data packets. LSPs can be point-to-point or point-to-multipoint. STAMP encapsulations for point-to-multipoint LSPs are outside the scope of this document. This document specifies STAMP encapsulations for point-to-point LSPs.¶
Pseudowires (PWs) are used in MPLS networks for various services, including Layer 2 and Layer 3 data packets [RFC6658]. PWs are bidirectional in nature. PWs may use the Control Word (CW) as defined in Section 3 of [RFC4385]. This document covers STAMP encapsulations for point-to-point PWs, whereas point-to-multipoint PWs are outside the scope of this document. PWs can be single-segment PWs or multi-segment PWs. This document specifies STAMP encapsulations for single-segment PWs; multi-segment PWs are outside the scope of this document.¶
MPLS Transport Profile (MPLS-TP) [RFC5960] is designed to use the MPLS data plane without any changes. Therefore, when STAMP is specified over an MPLS data plane, it is equally applicable to MPLS-TP networks. As specified in Section 2 of [RFC5921], "OAM and protection mechanisms, and forwarding of data packets, must be able to operate without IP forwarding support".¶
A Generic Associated Channel (G-ACh) [RFC5586] provides a mechanism for transporting Operations, Administration, and Maintenance (OAM) and other control messages over the MPLS data plane. The G-ACh types identify the various OAM messages that are being transported over the channel. Virtual Circuit Connectivity Verification (VCCV) is used as a Control Channel for PWs as described in [RFC5085]. A G-ACh can be used as a VCCV Control Channel as described in [RFC7708].¶
When using STAMP for MPLS and MPLS-TP for both LSPs and PWs, there are unique aspects that need to be considered concerning the use of CW, and these aspects are addressed in this document.¶
This document describes the procedure for the encapsulation of STAMP, defined in [RFC8762], and its optional extensions, defined in [RFC8972], for LSPs and PWs in MPLS networks. The procedure is also described for encapsulating STAMP test packets with or without the CW and/or an IP/UDP header for LSPs and PWs.¶
This document defines two new G-ACh types when using STAMP without an IP/UDP header. These types are independent of the PW demultiplexer type and are therefore applicable to both the PW label and the Layer 2 Tunneling Protocol version 3 (L2TPv3) PW demultiplexer. This document uses the existing G-ACh types for IPv4 and IPv6 when STAMP test packets are transmitted with an IP/UDP header for the LSPs and PWs that carry CW.¶
Additional considerations for encapsulating STAMP for performance measurement of Segment Routing LSPs over the MPLS data plane are described in [I-D.ietf-spring-stamp-srpm-mpls], and are outside the scope of this document.¶
STAMP test packets need to be transmitted with the same label stack used by the LSPs and PWs to ensure proper validation of the underlay path taken by the actual data traffic. In addition, STAMP test packets need to follow the same Equal-Cost Multi-Path (ECMP) underlay path taken by the LSP and PW data traffic in the network. PW data traffic may be encapsulated using CW, as defined in Section 3 of [RFC4385], and an IP header. As such, STAMP test packets need to be transmitted over these PWs using a G-ACh and an IP/UDP header.¶
When a STAMP test packet is transmitted to the target IP address of a STAMP Session-Reflector, it is encapsulated for an MPLS LSP by the data plane based on the reachability of that IP address over the LSP. Hence, the STAMP test packets are treated the same way as the data traffic forwarded over the LSP by the transit nodes along the path.¶
Data traffic over the L2-Specific Sublayer (L2SS), as used in L2TPv3 PWs, carries CW but does not carry an IP/UDP header. As such, STAMP test packets need to be transmitted over these L2TPv3 PWs using a G-ACh carrying only the STAMP payload without any IP/UDP header.¶
Private Line Emulation (PLE) [RFC9801] traffic is sent over a Packet Switched Network (PSN) as Virtual Private Wire Services (VPWS) using PWs. The data packets are encapsulated with PLE CW, but they do not carry any IP header. As such, STAMP test packets need to be transmitted using the same label stack, including the VPWS PW label as the PLE traffic [RFC9801], and encapsulated using a G-ACh but without an IP/UDP header. This allows STAMP test packets to experience the same forwarding behavior, follow the same underlay path as the PLE traffic, and avoid different ECMP behavior on intermediate nodes.¶
The G-ACh types allow for demultiplexing of the VCCV Control Channel for PWs [RFC7708]. The G-ACh types for STAMP test packets with or without IP/UDP headers are also used to demultiplex the VCCV Control Channel for PWs. Signaling extensions for the VCCV Control Channel for PWs for STAMP are outside the scope of this document.¶
The G-ACh provides support for the OAM Control Channel associated with MPLS-TP [RFC5960] LSPs and PWs. The OAM Control Channel for MPLS-TP needs to be extended to encapsulate STAMP test packets (just like the delay and loss measurement packets defined in [RFC6374]). The G-ACh types for STAMP also allow for the demultiplexing of the OAM Control Channel for MPLS-TP.¶
The requirements for the encapsulation of the STAMP test packets for the LSPs and PWs in MPLS networks can be summarized as follows:¶
The G-ACh needs to support STAMP test packets with an IP/UDP header.¶
The G-ACh needs to support STAMP test packets without an IP/UDP header.¶
The G-ACh types need to support demultiplexing of the Control Channel for STAMP test packets.¶
Session-Sender test packets need to follow the underlay path taken by the data traffic that uses CW.¶
Session-Sender test packets need to follow the same ECMP underlay path taken by the data traffic that uses CW and an Entropy Label defined in [RFC6790].¶
Session-Sender test packets need to follow the same ECMP underlay path taken by the data traffic that uses CW but does not use an Entropy Label defined in [RFC6790].¶
Session-Reflector test packets can follow the reverse underlay path taken by Session-Sender test packets.¶
Session-Reflector test packets can follow the same reverse ECMP underlay path taken by Session-Sender test packets.¶
Examples of MPLS data traffic use cases for STAMP test packets with IP/UDP headers are:¶
MPLS PW Data Traffic (with CW and IP header)¶
MPLS-TP PW Data Traffic (with CW and IP header)¶
MPLS LSP Data Traffic (with IP header)¶
Examples of MPLS data traffic use cases for STAMP test packets without IP/UDP headers are:¶
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶
| Abbreviation | Meaning | Reference |
|---|---|---|
| CE | Customer Edge | [RFC4026] |
| CW | Control Word | [RFC4385] |
| ECMP | Equal-Cost Multi-Path | [RFC6790] |
| G-ACh | Generic Associated Channel | [RFC5586] |
| GAL | Generic Associated Channel Label | [RFC5586] |
| GTSM | Generalized TTL Security Mechanism | [RFC5082] |
| HMAC | Hash-based Message Authentication Code | [RFC2104] |
| L2SS | L2-Specific Sublayer | [RFC3931] |
| L2TPv3 | Layer 2 Tunneling Protocol version 3 | [RFC3931] |
| L2VPN | Layer 2 Virtual Private Network | [RFC4026] |
| L3VPN | Layer 3 Virtual Private Network | [RFC4026] |
| LSP | Label Switched Path | [RFC3032] |
| MPLS | Multiprotocol Label Switching | [RFC3032] |
| MPLS-TP | MPLS Transport Profile | [RFC5960] |
| OAM | Operations, Administration, and Maintenance | [RFC5586] |
| PE | Provider Edge | [RFC4026] |
| PLE | Private Line Emulation | [RFC9801] |
| PSN | Packet Switched Network | [RFC9801] |
| PW | Pseudowire | [RFC6658] |
| S bit | Bottom of Stack bit | [RFC3032] |
| SSID | STAMP Session Identifier | [RFC8972] |
| STAMP | Simple Two-Way Active Measurement Protocol | [RFC8762] |
| TC | Traffic Class | [RFC5462] |
| TDM | Time-Division Multiplexing | [RFC5087] |
| TTL | Time to Live | [RFC3032] |
| VCCV | Virtual Circuit Connectivity Verification | [RFC5085] |
| VPWS | Virtual Private Wire Service | [RFC9801] |
In the STAMP reference topology shown in Figure 1, there is an LSP or a PW to transport data between Provider Edge (PE) endpoints S1 and R1. The STAMP Session-Sender on PE node S1 initiates a Session-Sender test packet, and the STAMP Session-Reflector on PE node R1 transmits a reply Session-Reflector test packet. The Session-Reflector test packet may be transmitted to the STAMP Session-Sender node S1 on the same path (that is, the same set of links and nodes) in the reverse direction of the path taken toward the Session-Reflector node R1.¶
|<-------- Pseudowire ------->|
|<-------- LSP -------------->|
| |
| T1 T2 |
| / \ |
+-------+ Test Packet +-------+
| | - - - - - - - - - ->| |
| S1 |=====================| R1 |
| |<- - - - - - - - - - | |
+-------+ Reply Test Packet +-------+
\ /
T4 T3
STAMP Session-Sender STAMP Session-Reflector
Provider Edge Endpoint Provider Edge Endpoint
T1 is a transmit timestamp, and T4 is a receive timestamp added by node S1. T2 is a receive timestamp, and T3 is a transmit timestamp added by node R1.¶
The STAMP test packets are used for both one-way and round-trip performance metrics, such as delay, delay variation, and packet loss [RFC8972].¶
The STAMP Session-Sender and Session-Reflector test packet payloads defined in [RFC8972] are encapsulated and transmitted over the LSPs and PWs in MPLS networks.¶
The base STAMP test packet payloads can be encapsulated using an IP/UDP header and destination UDP port 862 as the default destination port, as specified in Section 4.1 of [RFC8762]. When choosing a destination port from the User Ports range, the possible impact on the network needs to be carefully studied and agreed on by all users of the network domain where the test has been planned, as described in Section 4.1 of [RFC8762].¶
The source UDP port is chosen by the Session-Sender from the User Ports range, which MUST be different from 862 and MUST be able to distinguish between the received Session-Reflector test packets and the Session-Sender test packets from the reverse direction.¶
The STAMP Session Identifier (SSID) defined in [RFC8972] is used to identify the STAMP session and MUST be set to non-zero. The SSID MUST be carried in the STAMP test packets in both directions to be able to identify the STAMP sessions for MPLS LSPs and PWs.¶
The STAMP Session-Sender and Session-Reflector addresses for a STAMP session are provisioned on both endpoints of the MPLS LSP and PW.¶
STAMP test packet payloads are encapsulated over G-ACh in two formats: Format-1 (with an IP/UDP header) and Format-2 (without an IP/UDP header).¶
Format-1:¶
Format-2:¶
Following encapsulation use-cases provide the STAMP test packets with the same ECMP behaviour on the intermediate nodes as data traffic being measured:¶
When using an IP header, the IP version (IPv4 or IPv6) in the STAMP test packets MUST match the IP version used for the LSPs and PWs being measured. When an LSP carries both IPv4 and IPv6 data traffic, the IP version used in the STAMP test packet MUST match the IP version of the specific data traffic flow being measured.¶
The OAM Control Channel traffic between two PE endpoints is not forwarded beyond the PE endpoints toward Customer Edge (CE) devices; instead, the OAM messages are intercepted at the PE endpoints for exception processing in the control plane. [RFC5085] defines mechanisms for the VCCV Control Channel to carry OAM messages for PWs.¶
The "In-band VCCV for Control Word with 0001b as first nibble (Type 1)" defined in Section 5.1.1 of [RFC5085] MUST be added when measuring PWs with CW to avoid different ECMP hashing behaviour.¶
The method for "TTL Expiry VCCV (Type 3)" defined in Section 5.1.3 of [RFC5085] allows the termination of OAM messages on the remote PE endpoint nodes. This method is applied to the STAMP test packets to force the test packets to be processed on Session-Sender and Session-Reflector control planes by adding the PW label with a TTL value of 1.¶
VCCV Type 2 is also referred to as the "MPLS Router Alert Label" [RFC5085] This method could result in a different ECMP hashing behaviour, and thus result in the STAMP test packets taking a path that differs from that of the actual data traffic under test [RFC5085] Hence, the use of VCCV Type 2 for STAMP when measuring PW traffic is not supported by the procedures defined in this document.¶
The procedure described to encapsulate STAMP test packets for PWs is equally applicable to MPLS LSPs and MPLS-TP LSPs using CW in the following scenarios:¶
The IPv4 Time to Live (TTL), IPv6 Hop Limit, and Generalized TTL Security Mechanism (GTSM) procedures from [RFC5082] also apply to the encapsulation of STAMP test packets; hence, the IPv4 TTL, non-ultimate MPLS label TTL, and IPv6 Hop Limit MUST be set to 255. Note that the TTL in the ultimate PW label or LSP label is set separately to 1 when using the TTL Expiry method (VCCV Type 3) described above.¶
When the local processor cannot recompute the UDP checksum after adding the timestamp or add a checksum complement [RFC7820], the following procedures apply:¶
For IPv4 STAMP test packets, the Session-Sender and Session-Reflector set the UDP checksum value to 0 [RFC8085].¶
For IPv6 STAMP test packets, the Session-Sender and Session-Reflector use the procedure defined in [RFC6936] for UDP ports used in STAMP sessions to set the UDP checksum value to 0 and this can be based on a local policy.¶
The G-ACh label (GAL) defined in [RFC5586] also applies to the G-ACh types defined in this document for STAMP test packets without an IP/UDP header (Format-2). This use case is similar to the use case for MPLS-TP LSP performance measurement defined in [RFC6374]. As specified in Section 4.2 of [RFC5586], the GAL MUST NOT be used with PWs in MPLS-TP networks. Therefore, Format-2 encapsulation using GAL does not apply to MPLS-TP PWs.¶
The GAL applies to Format-1 using the G-ACh channel type for IPv4 (0x0021) or IPv6 (0x0057) as described in [RFC5586].¶
Control Channel Types defined in [RFC5085] are applicable to STAMP test packets for LSPs and PWs as shown in Table 2:¶
| Control Channel Type | Control Channel Name | STAMP Header Format | G-ACh Type |
|---|---|---|---|
| Type 1 | In-band: Control Word with 0001b as first nibble | Format-1 (IP/UDP Headers) | IPv4 G-ACh (0x0021) and IPv6 G-ACh (0x0057) |
| Type 1 | In-band: Control Word with 0001b as first nibble | Format-2 (No IP/UDP Headers) | STAMP G-ACh (TBA1 and TBA2) |
| Type 2 | Out-of-band: MPLS Router Alert Label | Not supported | Not supported |
| Type 3 | TTL Expiry: Label with TTL as 1 | Format-1 (IP/UDP Headers) | IPv4 G-ACh (0x0021) and IPv6 G-ACh (0x0057) |
| Type 3 | TTL Expiry: Label with TTL as 1 | Format-2 (No IP/UDP Headers) | STAMP G-ACh (TBA1 and TBA2) |
STAMP Session-Sender test packets are transmitted for an LSP or a PW using an MPLS header with or without an IP/UDP header. For PWs, Session-Sender test packets are transmitted using the label stack of the PW, including the PW label and the G-ACh. For LSPs, Session-Sender test packets are transmitted using the label stack of the LSP with or without a G-ACh.¶
The content of an example STAMP Session-Sender test packet for an LSP or a PW encapsulated using a G-ACh and an IP/UDP header is shown in Figure 2.¶
0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Label(1) | TC |0| TTL | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ . . . . . . +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | PW Label or Ultimate LSP Label | TC |1| 1 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |0 0 0 1|Version| Reserved | IPv4 (0x0021) or IPv6 (0x0057)| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | IP Header | . Source IP Address . . = Session-Sender IPv4 or IPv6 Address . . Destination IP Address . . = Session-Reflector IPv4 or IPv6 Address . . IPv4 Protocol or IPv6 Next Header = UDP (17) . . . +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | UDP Header | . Source Port = As chosen by Session-Sender . . Destination Port = User-configured Destination Port or 862 . . . +---------------------------------------------------------------+ | Payload = Test Packet as specified in Section 3 of RFC 8972 | . in Figure 1 and Figure 3 . . . +---------------------------------------------------------------+
The destination address in the IP header of a STAMP test packet can be one of the following when adding an MPLS encapsulation for an LSP or a PW.¶
A routable IPv4 address¶
A routable IPv6 address¶
An IPv4 address from the 127/8 range¶
An IPv6 address from the Dummy IPv6 Prefix 100:0:0:1::/64 [RFC9780] [IANA-IPv6-REG]¶
In the case of IPv6 address from the dummy prefix, as described in Section 1 of [RFC9780], this source-only prefix is deliberately used as a destination to generate an exception.¶
Examples of implementations are:¶
An implementation using a routable IP address as the destination address during the initial forwarding step, before the STAMP test packet gets forwarded into the MPLS LSP or PW.¶
An implementation using a non-routable IP address as the destination address while adding both an IP header and an MPLS encapsulation in the same forwarding step.¶
The G-ACh header [RFC5586] with the channel type for IPv4 or IPv6 MUST immediately follow the bottom of the label stack. The payload contains the STAMP Session-Sender test packet defined in [RFC8972].¶
The STAMP Session-Sender test packet G-ACh header contains the following fields:¶
The content of an example STAMP Session-Sender test packet for an LSP or a PW encapsulated using GAL and a G-ACh without an IP/UDP header is shown in Figure 3.¶
0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Label(1) | TC |0| TTL | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ . . . . . . +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | PW Label or Ultimate LSP Label | TC |0| 1 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | GAL | TC |1| 1 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |0 0 0 1|Version| Reserved | STAMP Sender G-ACh (TBA1) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Payload = Test Packet as specified in Section 3 of RFC 8972 | . in Figure 1 and Figure 3 . . . +---------------------------------------------------------------+
The G-ACh header [RFC5586] with the new STAMP Session-Sender channel type (value TBA1) MUST immediately follow the bottom of the label stack. The payload contains the STAMP Session-Sender test packet defined in [RFC8972].¶
The STAMP channel type allows the identification of the encapsulated STAMP payload when demultiplexing G-ACh.¶
The STAMP Session-Sender test packet G-ACh header contains the following fields:¶
The Session-Reflector processes and returns a received STAMP test packet as follows:¶
The Session-Reflector reflects the test packet to the Session-Sender using the same channel in the reverse direction of the LSP or PW on which it was received.¶
The Session-Reflector transmits the reflected test packet on the same path in the reverse direction of the LSP or PW.¶
The reflected test packet includes an IP/UDP header if the received Session-Sender test packet includes an IP/UDP header; otherwise, it is sent without an IP/UDP header.¶
The Session-Reflector uses the PW label or ultimate LSP label in the received packet to find the reverse-direction LSP or PW context.¶
If the received packet context is a PW, the Session-Reflector uses the reverse-direction PW label stack and G-ACh to transmit the Session-Reflector test packet. The reverse-direction PW label stack is determined through static configuration or the signaling protocol used to establish the PW.¶
If the received packet context is an LSP, the Session-Reflector uses the reverse-direction LSP label stack, with or without a G-ACh as applicable, to transmit the Session-Reflector test packet.¶
When a G-ACh is used, the Session-Reflector test packet uses the same G-ACh as the received Session-Sender test packet.¶
If the Session-Reflector cannot find a reverse-direction LSP or PW context for the received test packet, it MUST discard the received packet and MUST NOT transmit a reply.¶
The content of an example STAMP Session-Reflector test packet for an LSP or a PW encapsulated using a G-ACh and an IP/UDP header is shown in Figure 4.¶
0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Label(1) | TC |0| TTL | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ . . . . . . +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | PW Label or Ultimate LSP Label | TC |1| 1 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |0 0 0 1|Version| Reserved | IPv4 (0x0021) or IPv6 (0x0057)| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | IP Header | . Source IP Address . . = Configured on Session-Reflector . . Destination IP Address . . = Source IP Address from Session-Sender Test Packet . . IPv4 Protocol or IPv6 Next Header = UDP (17) . . . +---------------------------------------------------------------+ | UDP Header | . Source Port = As chosen by Session-Reflector . . Destination Port . . = Source Port from Session-Sender Test Packet . . . +---------------------------------------------------------------+ | Payload = Test Packet as specified in Section 3 of RFC 8972 | . in Figure 2 and Figure 4 . . . +---------------------------------------------------------------+
The G-ACh header [RFC5586] with the channel type IPv4 or IPv6 MUST immediately follow the bottom of the label stack. The payload contains the STAMP Session-Reflector test packet defined in [RFC8972].¶
The STAMP Session-Reflector test packet MUST use the IP/UDP information from the received test packet when an IP/UDP header is present in the received test packet.¶
The STAMP Session-Reflector test packet G-ACh header contains the following fields:¶
The content of an example STAMP Session-Reflector test packet for an LSP or a PW encapsulated using GAL and a G-ACh without an IP/UDP header is shown in Figure 5.¶
0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Label(1) | TC |0| TTL | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ . . . . . . +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | PW Label or Ultimate LSP Label | TC |0| 1 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | GAL | TC |1| 1 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |0 0 0 1|Version| Reserved | STAMP Reflector G-ACh (TBA2) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Payload = Test Packet as specified in Section 3 of RFC 8972 | . in Figure 2 and Figure 4 . . . +---------------------------------------------------------------+
The G-ACh header [RFC5586] with the new STAMP Session-Reflector channel type (value TBA2) MUST immediately follow the bottom of the label stack. The payload contains the STAMP Session-Reflector test packet defined in [RFC8972].¶
The STAMP channel type allows the identification of the encapsulated STAMP payload when demultiplexing G-ACh.¶
The STAMP Session-Reflector test packet G-ACh header contains the following fields:¶
The operational considerations specified in Section 5 of [RFC8762] also apply to the procedure described in this document. Further, the operation and management of performance measurement based on STAMP specified in Section 3 of [RFC8762] also apply to the procedure described in this document.¶
Based on local policy, an operator may add the MPLS encapsulation only for STAMP test packets destined to addresses within the MPLS administrative domain.¶
The encapsulation procedure defined in this document uses a G-ACh for STAMP test packets to follow the path of the data packets with CW. This assumes that intermediate nodes apply the same ECMP hashing behaviour to STAMP test packets with G-ACh as to data packets with CW when using the same label stack.¶
On both Session-Sender and Session-Reflector nodes, each STAMP test packet is punted to the control plane and is subject to rate limiting. Such policing on the punt path is indistinguishable from the actual loss in the network and can therefore be reported as packet loss. Operators should account for this when configuring punt-path rate limiters, as discussed in Section 9 of [RFC5085] and Section 5 of [RFC9780].¶
The rate at which STAMP test packets are transmitted needs to be configured and accounted for when provisioning the bandwidth of the LSP or PW. This applies to both Format-1 and Format-2 test packets, including the encapsulation overhead. The congestion and bandwidth usage considerations for VCCV applications in Section 9 of [RFC5085] apply to STAMP test packets carried over PWs, including Format-2 packets that do not contain UDP. Operators should also consider the additional traffic generated by the Session-Reflector and the rate of control packets passed to the control plane, as described in Section 6 of [RFC9780].¶
Because the Session-Reflector responds to each received test packet, the following considerations apply when provisioning bandwidth:¶
The reflected direction can generate a comparable test packet rate and needs to be considered independently when provisioning the reverse-direction LSP or PW.¶
The configured test rate needs to be appropriate for the capacity of both directions.¶
The configured rate needs to account for cases where the reverse direction has less capacity than the forward direction.¶
Any rate limit or bound applied to the Session-Sender rate needs to prevent the corresponding reflected traffic from exceeding the reverse-direction capacity.¶
The size of a STAMP test packet, including the encapsulation overhead, needs to fit within the LSP or PW MTU independently in both directions. Further, the padding defined in [RFC8972] needs to be considered when selecting the test packet size.¶
A test packet with G-ACh encapsulation that exceeds the LSP or PW MTU is dropped rather than fragmented and can therefore appear as packet loss. Format-1 test packets should be sized to avoid IP fragmentation.¶
Forwarding STAMP test packets on a broken LSP would cause the STAMP session to be down when all packets on the LSP are dropped. Otherwise, when the packets are incorrectly forwarded by MPLS or IP to the egress node (hosting the STAMP Session-Reflector), it could lead to an invalid measurement of the LSP, for example, if the packets followed a different path than the LSP. A non-routable IPv4/IPv6 destination address, described in Section 4.1, avoids IP forwarding of the Session-Sender test packets to the egress node on a different path than the LSP. However, there is a potential risk of receiving Session-Reflector test packets from an unintended STAMP Session-Reflector hosted on the node where the broken LSP terminates, since the STAMP Session-Reflector may not know that the test packets were received due to a broken LSP. In this case, network analytics would detect invalid measurements reported by STAMP over a broken LSP path.¶
Further, the destination IP address-based filtering SHOULD be provisioned on the edges of the MPLS administrative domain to prevent the IP-forwarded STAMP test packets for a broken LSP within the domain from leaking outside the domain. A non-routable IPv4/IPv6 destination address, described in Section 4.1, MAY be used in STAMP test packets to help avoid this.¶
The considerations described above also apply to the reverse direction. In particular, when the reverse LSP is broken, a Session-Reflector test packet with an IP/UDP header may be incorrectly forwarded by MPLS or IP to the ingress node (hosting the STAMP Session-Sender). This is because its destination address is the Session-Sender's source address, which is routable. The non-routable destination address technique described above does not protect the reflected packet. Operators SHOULD therefore apply appropriate filtering policies at the edges of the MPLS administrative domain to prevent reflected STAMP test packets from leaking outside the domain.¶
The procedures defined in this document are intended for deployment in a single network administrative domain. As such, the Session-Sender address, Session-Reflector address, and IP and MPLS forward and return paths are provisioned by the operator for the STAMP session. It is assumed that the operator has verified the integrity of the IP and MPLS forward and return paths used to transmit STAMP test packets.¶
The security considerations specified in [RFC8762] and [RFC8972] also apply to the procedure described in this document. Specifically, the message integrity protection using HMAC, as defined in Section 4.4 of [RFC8762], also applies to the procedure described in this document. The measures specified in Section 7 of [RFC8762] to mitigate attacks using the registered UDP port number also apply.¶
Routers that support G-ACh are subject to the same security considerations as defined in [RFC4385] and [RFC5586].¶
The message throttling mechanisms described in the security considerations in Section 10 of [RFC5085] to protect against potential (deliberate or unintentional) attacks also apply to the procedure described in this document.¶
If desired, attacks can be mitigated by performing basic validation checks (such as whether timestamp T2 is later than timestamp T1 in the STAMP Reference Topology shown in Figure 1, when the Session-Sender and Session-Reflector clocks are synchronized) in Session-Reflector test packets received at the Session-Sender. The minimal state associated with this protocol also limits the extent of measurement disruption that can be caused by a corrupt or invalid test packet to a single test cycle.¶
An attacker can send a forged STAMP test packet to the ingress or egress node of an LSP, causing the STAMP session to be terminated prematurely. To mitigate these threats, operators SHOULD filter STAMP test packets at the edges of the MPLS administrative domain.¶
Furthermore, implementations SHOULD NOT assign SSIDs [RFC8972] in a predictable manner. To avoid predictability, implementations can leverage a Cryptographically Secure Pseudorandom Number Generator [NIST-CSPRNG].¶
The STAMP test packets received via a PW or an LSP are processed in the context of that PW or LSP, and the encapsulations defined in this document do not introduce a mechanism for cross-service OAM interactions.¶
IANA maintains the G-ACh Type Registry (see https://www.iana.org/assignments/g-ach-parameters/g-ach-parameters.xhtml). IANA is requested to allocate values for the G-ACh Types for STAMP from the "MPLS Generalized Associated Channel (G-ACh) Types (including Pseudowire Associated Channel Types)" registry.¶
| Value | Description | Reference |
|---|---|---|
| TBA1 | STAMP Session-Sender G-ACh Type | This document |
| TBA2 | STAMP Session-Reflector G-ACh Type | This document |
The authors would like to thank Bharath Vasudevan, Ali Sianati, and Parag Jain for the discussions on the method to punt STAMP test packets to the control plane for processing. The authors would also like to thank Greg Mirsky, Loa Andersson, Li Zhang, Richard Foote (Footer), and Stewart Bryant for reviewing this document and providing useful comments and suggestions. Thanks to Carlos Pignataro for the PerfMetrdir review, Russ White for the early Rtgdir review, Russ Housley for the Gen-ART review, Vidhi Goel for the TSVART review, Giuseppe Fioccola for the Opsdir review, and Yaron Sheffer for the early Secdir review which helped improve this document.¶