Encapsulation of Simple Two-Way Active Measurement Protocol for LSPs and Pseudowires in MPLS Networks

The Simple Two-Way Active Measurement Protocol (STAMP) provides capabilities for measuring various metrics in IP networks without the use of a control channel to pre-signal session parameters. defines optional extensions for STAMP. Label Switched Paths (LSPs) are used in MPLS networks for various services, including Layer 2 and Layer 3 data packets. LSPs can be point-to-point or point-to-multipoint. STAMP encapsulations for point-to-multipoint LSPs are outside the scope of this document. This document specifies STAMP encapsulations for point-to-point LSPs. Pseudowires (PWs) are used in MPLS networks for various services, including Layer 2 and Layer 3 data packets . PWs are bidirectional in nature. PWs may use the Control Word (CW) as defined in Section 3 of . This document covers STAMP encapsulations for point-to-point PWs, whereas point-to-multipoint PWs are outside the scope of this document. PWs can be single-segment PWs or multi-segment PWs. This document specifies STAMP encapsulations for single-segment PWs; multi-segment PWs are outside the scope of this document. MPLS Transport Profile (MPLS-TP) is designed to use the MPLS data plane without any changes. Therefore, when STAMP is specified over an MPLS data plane, it is equally applicable to MPLS-TP networks. As specified in Section 2 of , "OAM and protection mechanisms, and forwarding of data packets, must be able to operate without IP forwarding support". A Generic Associated Channel (G-ACh) provides a mechanism for transporting Operations, Administration, and Maintenance (OAM) and other control messages over the MPLS data plane. The G-ACh types identify the various OAM messages that are being transported over the channel. Virtual Circuit Connectivity Verification (VCCV) is used as a Control Channel for PWs as described in . A G-ACh can be used as a VCCV Control Channel as described in . When using STAMP for MPLS and MPLS-TP for both LSPs and PWs, there are unique aspects that need to be considered concerning the use of CW, and these aspects are addressed in this document. This document describes the procedure for the encapsulation of STAMP, defined in , and its optional extensions, defined in , for LSPs and PWs in MPLS networks. The procedure is also described for encapsulating STAMP test packets with or without the CW and/or an IP/UDP header for LSPs and PWs. This document defines two new G-ACh types when using STAMP without an IP/UDP header. These types are independent of the PW demultiplexer type and are therefore applicable to both the PW label and the Layer 2 Tunneling Protocol version 3 (L2TPv3) PW demultiplexer. This document uses the existing G-ACh types for IPv4 and IPv6 when STAMP test packets are transmitted with an IP/UDP header for the LSPs and PWs that carry CW. Additional considerations for encapsulating STAMP for performance measurement of Segment Routing LSPs over the MPLS data plane are described in , and are outside the scope of this document.

STAMP test packets need to be transmitted with the same label stack used by the LSPs and PWs to ensure proper validation of the underlay path taken by the actual data traffic. In addition, STAMP test packets need to follow the same Equal-Cost Multi-Path (ECMP) underlay path taken by the LSP and PW data traffic in the network. PW data traffic may be encapsulated using CW, as defined in Section 3 of , and an IP header. As such, STAMP test packets need to be transmitted over these PWs using a G-ACh and an IP/UDP header. When a STAMP test packet is transmitted to the target IP address of a STAMP Session-Reflector, it is encapsulated for an MPLS LSP by the data plane based on the reachability of that IP address over the LSP. Hence, the STAMP test packets are treated the same way as the data traffic forwarded over the LSP by the transit nodes along the path. Data traffic over the L2-Specific Sublayer (L2SS), as used in L2TPv3 PWs, carries CW but does not carry an IP/UDP header. As such, STAMP test packets need to be transmitted over these L2TPv3 PWs using a G-ACh carrying only the STAMP payload without any IP/UDP header. Private Line Emulation (PLE) traffic is sent over a Packet Switched Network (PSN) as Virtual Private Wire Services (VPWS) using PWs. The data packets are encapsulated with PLE CW, but they do not carry any IP header. As such, STAMP test packets need to be transmitted using the same label stack, including the VPWS PW label as the PLE traffic , and encapsulated using a G-ACh but without an IP/UDP header. This allows STAMP test packets to experience the same forwarding behavior, follow the same underlay path as the PLE traffic, and avoid different ECMP behavior on intermediate nodes. The G-ACh types allow for demultiplexing of the VCCV Control Channel for PWs . The G-ACh types for STAMP test packets with or without IP/UDP headers are also used to demultiplex the VCCV Control Channel for PWs. Signaling extensions for the VCCV Control Channel for PWs for STAMP are outside the scope of this document. The G-ACh provides support for the OAM Control Channel associated with MPLS-TP LSPs and PWs. The OAM Control Channel for MPLS-TP needs to be extended to encapsulate STAMP test packets (just like the delay and loss measurement packets defined in ). The G-ACh types for STAMP also allow for the demultiplexing of the OAM Control Channel for MPLS-TP. The requirements for the encapsulation of the STAMP test packets for the LSPs and PWs in MPLS networks can be summarized as follows:

The G-ACh needs to support STAMP test packets with an IP/UDP header.
The G-ACh needs to support STAMP test packets without an IP/UDP header.
The G-ACh types need to support demultiplexing of the Control Channel for STAMP test packets.
Session-Sender test packets need to follow the underlay path taken by the data traffic that uses CW.
Session-Sender test packets need to follow the same ECMP underlay path taken by the data traffic that uses CW and an Entropy Label defined in .
Session-Sender test packets need to follow the same ECMP underlay path taken by the data traffic that uses CW but does not use an Entropy Label defined in .
Session-Reflector test packets can follow the reverse underlay path taken by Session-Sender test packets.
Session-Reflector test packets can follow the same reverse ECMP underlay path taken by Session-Sender test packets.

Examples of MPLS data traffic use cases for STAMP test packets with IP/UDP headers are:

MPLS PW Data Traffic (with CW and IP header)
MPLS-TP PW Data Traffic (with CW and IP header)
MPLS LSP Data Traffic (with IP header)

Examples of MPLS data traffic use cases for STAMP test packets without IP/UDP headers are:

MPLS Ethernet PW Data Traffic
L2SS used in L2TPv3 PW Data Traffic
Private Line Emulation PW Data Traffic
TDM over IP PW Data Traffic (with no IP header)
MPLS-TP LSP Data Traffic

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

Abbreviations

Abbreviation	Meaning	Reference
CE	Customer Edge
CW	Control Word
ECMP	Equal-Cost Multi-Path
G-ACh	Generic Associated Channel
GAL	Generic Associated Channel Label
GTSM	Generalized TTL Security Mechanism
HMAC	Hash-based Message Authentication Code
L2SS	L2-Specific Sublayer
L2TPv3	Layer 2 Tunneling Protocol version 3
L2VPN	Layer 2 Virtual Private Network
L3VPN	Layer 3 Virtual Private Network
LSP	Label Switched Path
MPLS	Multiprotocol Label Switching
MPLS-TP	MPLS Transport Profile
OAM	Operations, Administration, and Maintenance
PE	Provider Edge
PLE	Private Line Emulation
PSN	Packet Switched Network
PW	Pseudowire
S bit	Bottom of Stack bit
SSID	STAMP Session Identifier
STAMP	Simple Two-Way Active Measurement Protocol
TC	Traffic Class
TDM	Time-Division Multiplexing
TTL	Time to Live
VCCV	Virtual Circuit Connectivity Verification
VPWS	Virtual Private Wire Service

In the STAMP reference topology shown in , there is an LSP or a PW to transport data between Provider Edge (PE) endpoints S1 and R1. The STAMP Session-Sender on PE node S1 initiates a Session-Sender test packet, and the STAMP Session-Reflector on PE node R1 transmits a reply Session-Reflector test packet. The Session-Reflector test packet may be transmitted to the STAMP Session-Sender node S1 on the same path (that is, the same set of links and nodes) in the reverse direction of the path taken toward the Session-Reflector node R1.

| |<-------- LSP -------------->| | | | T1 T2 | | / \ | +-------+ Test Packet +-------+ | | - - - - - - - - - ->| | | S1 |=====================| R1 | | |<- - - - - - - - - - | | +-------+ Reply Test Packet +-------+ \ / T4 T3 STAMP Session-Sender STAMP Session-Reflector Provider Edge Endpoint Provider Edge Endpoint ]]> T1 is a transmit timestamp, and T4 is a receive timestamp added by node S1. T2 is a receive timestamp, and T3 is a transmit timestamp added by node R1. The STAMP test packets are used for both one-way and round-trip performance metrics, such as delay, delay variation, and packet loss .

The STAMP Session-Sender and Session-Reflector test packet payloads defined in are encapsulated and transmitted over the LSPs and PWs in MPLS networks. The base STAMP test packet payloads can be encapsulated using an IP/UDP header and destination UDP port 862 as the default destination port, as specified in Section 4.1 of . When choosing a destination port from the User Ports range, the possible impact on the network needs to be carefully studied and agreed on by all users of the network domain where the test has been planned, as described in Section 4.1 of . The source UDP port is chosen by the Session-Sender from the User Ports range, which MUST be different from 862 and MUST be able to distinguish between the received Session-Reflector test packets and the Session-Sender test packets from the reverse direction. The STAMP Session Identifier (SSID) defined in is used to identify the STAMP session and MUST be set to non-zero. The SSID MUST be carried in the STAMP test packets in both directions to be able to identify the STAMP sessions for MPLS LSPs and PWs. The STAMP Session-Sender and Session-Reflector addresses for a STAMP session are provisioned on both endpoints of the MPLS LSP and PW.

STAMP test packet payloads are encapsulated over G-ACh in two formats: Format-1 (with an IP/UDP header) and Format-2 (without an IP/UDP header).

Format-1: For encapsulating the STAMP test packet payloads over a G-ACh with IP/UDP headers, IPv4 and IPv6 channel types are used for both Session-Sender and Session-Reflector test packets. The destination UDP port number in the Session-Sender and Session-Reflector test packets distinguishes the test packets.
Format-2: For encapsulating the STAMP test packet payloads over a G-ACh without adding IP/UDP headers, two new channel types are defined in this document: one for the Session-Sender test packets and one for the Session-Reflector test packets. The different channel types are required for the Session-Sender and Session-Reflector test packets as the STAMP test packets do not have a way to discriminate between them.

Format-1:
- The Session-Reflector address that is the source address, destination UDP port, and the SSID in the received Session-Reflector test packets, along with the locally provisioned STAMP session parameters are used by the Session-Sender to identify a STAMP session.
- The Session-Sender address that is the source address, destination UDP port, and the SSID in the received Session-Sender test packets, along with the locally provisioned STAMP session parameters are used by the Stateful Session-Reflector to identify a STAMP session.
Format-2:
- The SSID along with the reverse direction LSP and PW context in the received Session-Reflector test packets, along with the locally provisioned STAMP session parameters are used by the Session-Sender to identify a STAMP session.
- The SSID along with the LSP and PW context in the received Session-Sender test packets, along with the locally provisioned STAMP session parameters are used by the Stateful Session-Reflector to identify a STAMP session.

Following encapsulation use-cases provide the STAMP test packets with the same ECMP behaviour on the intermediate nodes as data traffic being measured:

The STAMP test packet payloads are encapsulated with an IP/UDP header without a G-ACh header, and with an MPLS header using the same label stack as the MPLS LSP and MPLS-TP LSP data traffic that contains an IP header but not the CW. The label stack may include the L2 or L3 VPN label for the service carried over the LSP.
The STAMP test packet payloads are encapsulated with an IP/UDP header with a G-ACh header (instead of the CW used by the data traffic), and with an MPLS header using the same label stack as the MPLS LSP and MPLS-TP LSP data traffic that contains an IP header and the CW. The label stack may include the L2 or L3 VPN label for the service carried over the LSP.
The STAMP test packet payloads are encapsulated with an MPLS header using the same label stack as the PW data traffic (including the PW label) and a G-ACh header (instead of the CW used by the data traffic). The encapsulation allows STAMP test packets to follow the same path as the PW data traffic.

When using an IP header, the IP version (IPv4 or IPv6) in the STAMP test packets MUST match the IP version used for the LSPs and PWs being measured. When an LSP carries both IPv4 and IPv6 data traffic, the IP version used in the STAMP test packet MUST match the IP version of the specific data traffic flow being measured.

The OAM Control Channel traffic between two PE endpoints is not forwarded beyond the PE endpoints toward Customer Edge (CE) devices; instead, the OAM messages are intercepted at the PE endpoints for exception processing in the control plane. defines mechanisms for the VCCV Control Channel to carry OAM messages for PWs.

The "In-band VCCV for Control Word with 0001b as first nibble (Type 1)" defined in Section 5.1.1 of MUST be added when measuring PWs with CW to avoid different ECMP hashing behaviour.
The method for "TTL Expiry VCCV (Type 3)" defined in Section 5.1.3 of allows the termination of OAM messages on the remote PE endpoint nodes. This method is applied to the STAMP test packets to force the test packets to be processed on Session-Sender and Session-Reflector control planes by adding the PW label with a TTL value of 1.
VCCV Type 2 is also referred to as the "MPLS Router Alert Label" This method could result in a different ECMP hashing behaviour, and thus result in the STAMP test packets taking a path that differs from that of the actual data traffic under test Hence, the use of VCCV Type 2 for STAMP when measuring PW traffic is not supported by the procedures defined in this document.

The procedure described to encapsulate STAMP test packets for PWs is equally applicable to MPLS LSPs and MPLS-TP LSPs using CW in the following scenarios:

For data traffic over MPLS LSPs using an IP header, STAMP test packets in Format-1 are transmitted.
For data traffic without an IP header over MPLS-TP LSPs, STAMP test packets in Format-2 are transmitted with a TTL value of 1 in the ultimate LSP label in the MPLS header.

The IPv4 Time to Live (TTL), IPv6 Hop Limit, and Generalized TTL Security Mechanism (GTSM) procedures from also apply to the encapsulation of STAMP test packets; hence, the IPv4 TTL, non-ultimate MPLS label TTL, and IPv6 Hop Limit MUST be set to 255. Note that the TTL in the ultimate PW label or LSP label is set separately to 1 when using the TTL Expiry method (VCCV Type 3) described above.

When the local processor cannot recompute the UDP checksum after adding the timestamp or add a checksum complement , the following procedures apply:

For IPv4 STAMP test packets, the Session-Sender and Session-Reflector set the UDP checksum value to 0 .
For IPv6 STAMP test packets, the Session-Sender and Session-Reflector use the procedure defined in for UDP ports used in STAMP sessions to set the UDP checksum value to 0 and this can be based on a local policy.

The G-ACh label (GAL) defined in also applies to the G-ACh types defined in this document for STAMP test packets without an IP/UDP header (Format-2). This use case is similar to the use case for MPLS-TP LSP performance measurement defined in . As specified in Section 4.2 of , the GAL MUST NOT be used with PWs in MPLS-TP networks. Therefore, Format-2 encapsulation using GAL does not apply to MPLS-TP PWs. The GAL applies to Format-1 using the G-ACh channel type for IPv4 (0x0021) or IPv6 (0x0057) as described in .

Control Channel Types defined in are applicable to STAMP test packets for LSPs and PWs as shown in : Control Channel Type Control Channel Name STAMP Header Format G-ACh Type Type 1 In-band: Control Word with 0001b as first nibble Format-1 (IP/UDP Headers) IPv4 G-ACh (0x0021) and IPv6 G-ACh (0x0057) Type 1 In-band: Control Word with 0001b as first nibble Format-2 (No IP/UDP Headers) STAMP G-ACh (TBA1 and TBA2) Type 2 Out-of-band: MPLS Router Alert Label Not supported Not supported Type 3 TTL Expiry: Label with TTL as 1 Format-1 (IP/UDP Headers) IPv4 G-ACh (0x0021) and IPv6 G-ACh (0x0057) Type 3 TTL Expiry: Label with TTL as 1 Format-2 (No IP/UDP Headers) STAMP G-ACh (TBA1 and TBA2)

STAMP Session-Sender test packets are transmitted for an LSP or a PW using an MPLS header with or without an IP/UDP header. For PWs, Session-Sender test packets are transmitted using the label stack of the PW, including the PW label and the G-ACh. For LSPs, Session-Sender test packets are transmitted using the label stack of the LSP with or without a G-ACh.

The content of an example STAMP Session-Sender test packet for an LSP or a PW encapsulated using a G-ACh and an IP/UDP header is shown in .

The destination address in the IP header of a STAMP test packet can be one of the following when adding an MPLS encapsulation for an LSP or a PW.

A routable IPv4 address
A routable IPv6 address
An IPv4 address from the 127/8 range
An IPv6 address from the Dummy IPv6 Prefix 100:0:0:1::/64

In the case of IPv6 address from the dummy prefix, as described in Section 1 of , this source-only prefix is deliberately used as a destination to generate an exception. Examples of implementations are:

An implementation using a routable IP address as the destination address during the initial forwarding step, before the STAMP test packet gets forwarded into the MPLS LSP or PW.
An implementation using a non-routable IP address as the destination address while adding both an IP header and an MPLS encapsulation in the same forwarding step.

The G-ACh header with the channel type for IPv4 or IPv6 MUST immediately follow the bottom of the label stack. The payload contains the STAMP Session-Sender test packet defined in . The STAMP Session-Sender test packet G-ACh header contains the following fields:

Version: The Version field is set to 0, as defined in .
Reserved: Reserved bits MUST be set to zero upon transmission and ignored upon receipt.
Channel Type: G-ACh type for IPv4 header (0x0021) or IPv6 header (0x0057) .

The content of an example STAMP Session-Sender test packet for an LSP or a PW encapsulated using GAL and a G-ACh without an IP/UDP header is shown in .

The G-ACh header with the new STAMP Session-Sender channel type (value TBA1) MUST immediately follow the bottom of the label stack. The payload contains the STAMP Session-Sender test packet defined in . The STAMP channel type allows the identification of the encapsulated STAMP payload when demultiplexing G-ACh. The STAMP Session-Sender test packet G-ACh header contains the following fields:

Version: The Version field is set to 0, as defined in .
Reserved: Reserved bits MUST be set to zero upon transmission and ignored upon receipt.
Channel Type: G-ACh type for STAMP Session-Sender packet (TBA1).

The Session-Reflector processes and returns a received STAMP test packet as follows:

The Session-Reflector reflects the test packet to the Session-Sender using the same channel in the reverse direction of the LSP or PW on which it was received.
The Session-Reflector transmits the reflected test packet on the same path in the reverse direction of the LSP or PW.
The reflected test packet includes an IP/UDP header if the received Session-Sender test packet includes an IP/UDP header; otherwise, it is sent without an IP/UDP header.
The Session-Reflector uses the PW label or ultimate LSP label in the received packet to find the reverse-direction LSP or PW context.
If the received packet context is a PW, the Session-Reflector uses the reverse-direction PW label stack and G-ACh to transmit the Session-Reflector test packet. The reverse-direction PW label stack is determined through static configuration or the signaling protocol used to establish the PW.
If the received packet context is an LSP, the Session-Reflector uses the reverse-direction LSP label stack, with or without a G-ACh as applicable, to transmit the Session-Reflector test packet.
When a G-ACh is used, the Session-Reflector test packet uses the same G-ACh as the received Session-Sender test packet.
If the Session-Reflector cannot find a reverse-direction LSP or PW context for the received test packet, it MUST discard the received packet and MUST NOT transmit a reply.

The content of an example STAMP Session-Reflector test packet for an LSP or a PW encapsulated using a G-ACh and an IP/UDP header is shown in .

The G-ACh header with the channel type IPv4 or IPv6 MUST immediately follow the bottom of the label stack. The payload contains the STAMP Session-Reflector test packet defined in . The STAMP Session-Reflector test packet MUST use the IP/UDP information from the received test packet when an IP/UDP header is present in the received test packet. The STAMP Session-Reflector test packet G-ACh header contains the following fields:

Version: The Version field is set to 0, as defined in .
Reserved: Reserved bits MUST be set to zero upon transmission and ignored upon receipt.
Channel Type: G-ACh type for IPv4 header (0x0021) or IPv6 header (0x0057) .

The content of an example STAMP Session-Reflector test packet for an LSP or a PW encapsulated using GAL and a G-ACh without an IP/UDP header is shown in .

The G-ACh header with the new STAMP Session-Reflector channel type (value TBA2) MUST immediately follow the bottom of the label stack. The payload contains the STAMP Session-Reflector test packet defined in . The STAMP channel type allows the identification of the encapsulated STAMP payload when demultiplexing G-ACh. The STAMP Session-Reflector test packet G-ACh header contains the following fields:

Version: The Version field is set to 0, as defined in .
Reserved: Reserved bits MUST be set to zero upon transmission and ignored upon receipt.
Channel Type: G-ACh type for STAMP Session-Reflector packet (TBA2).

The operational considerations specified in Section 5 of also apply to the procedure described in this document. Further, the operation and management of performance measurement based on STAMP specified in Section 3 of also apply to the procedure described in this document. Based on local policy, an operator may add the MPLS encapsulation only for STAMP test packets destined to addresses within the MPLS administrative domain. The encapsulation procedure defined in this document uses a G-ACh for STAMP test packets to follow the path of the data packets with CW. This assumes that intermediate nodes apply the same ECMP hashing behaviour to STAMP test packets with G-ACh as to data packets with CW when using the same label stack.

On both Session-Sender and Session-Reflector nodes, each STAMP test packet is punted to the control plane and is subject to rate limiting. Such policing on the punt path is indistinguishable from the actual loss in the network and can therefore be reported as packet loss. Operators should account for this when configuring punt-path rate limiters, as discussed in Section 9 of and Section 5 of .

The rate at which STAMP test packets are transmitted needs to be configured and accounted for when provisioning the bandwidth of the LSP or PW. This applies to both Format-1 and Format-2 test packets, including the encapsulation overhead. The congestion and bandwidth usage considerations for VCCV applications in Section 9 of apply to STAMP test packets carried over PWs, including Format-2 packets that do not contain UDP. Operators should also consider the additional traffic generated by the Session-Reflector and the rate of control packets passed to the control plane, as described in Section 6 of . Because the Session-Reflector responds to each received test packet, the following considerations apply when provisioning bandwidth:

The reflected direction can generate a comparable test packet rate and needs to be considered independently when provisioning the reverse-direction LSP or PW.
The configured test rate needs to be appropriate for the capacity of both directions.
The configured rate needs to account for cases where the reverse direction has less capacity than the forward direction.
Any rate limit or bound applied to the Session-Sender rate needs to prevent the corresponding reflected traffic from exceeding the reverse-direction capacity.

The size of a STAMP test packet, including the encapsulation overhead, needs to fit within the LSP or PW MTU independently in both directions. Further, the padding defined in needs to be considered when selecting the test packet size. A test packet with G-ACh encapsulation that exceeds the LSP or PW MTU is dropped rather than fragmented and can therefore appear as packet loss. Format-1 test packets should be sized to avoid IP fragmentation.

Forwarding STAMP test packets on a broken LSP would cause the STAMP session to be down when all packets on the LSP are dropped. Otherwise, when the packets are incorrectly forwarded by MPLS or IP to the egress node (hosting the STAMP Session-Reflector), it could lead to an invalid measurement of the LSP, for example, if the packets followed a different path than the LSP. A non-routable IPv4/IPv6 destination address, described in , avoids IP forwarding of the Session-Sender test packets to the egress node on a different path than the LSP. However, there is a potential risk of receiving Session-Reflector test packets from an unintended STAMP Session-Reflector hosted on the node where the broken LSP terminates, since the STAMP Session-Reflector may not know that the test packets were received due to a broken LSP. In this case, network analytics would detect invalid measurements reported by STAMP over a broken LSP path. Further, the destination IP address-based filtering SHOULD be provisioned on the edges of the MPLS administrative domain to prevent the IP-forwarded STAMP test packets for a broken LSP within the domain from leaking outside the domain. A non-routable IPv4/IPv6 destination address, described in , MAY be used in STAMP test packets to help avoid this. The considerations described above also apply to the reverse direction. In particular, when the reverse LSP is broken, a Session-Reflector test packet with an IP/UDP header may be incorrectly forwarded by MPLS or IP to the ingress node (hosting the STAMP Session-Sender). This is because its destination address is the Session-Sender's source address, which is routable. The non-routable destination address technique described above does not protect the reflected packet. Operators SHOULD therefore apply appropriate filtering policies at the edges of the MPLS administrative domain to prevent reflected STAMP test packets from leaking outside the domain.

The procedures defined in this document are intended for deployment in a single network administrative domain. As such, the Session-Sender address, Session-Reflector address, and IP and MPLS forward and return paths are provisioned by the operator for the STAMP session. It is assumed that the operator has verified the integrity of the IP and MPLS forward and return paths used to transmit STAMP test packets. The security considerations specified in and also apply to the procedure described in this document. Specifically, the message integrity protection using HMAC, as defined in Section 4.4 of , also applies to the procedure described in this document. The measures specified in Section 7 of to mitigate attacks using the registered UDP port number also apply. Routers that support G-ACh are subject to the same security considerations as defined in and . The message throttling mechanisms described in the security considerations in Section 10 of to protect against potential (deliberate or unintentional) attacks also apply to the procedure described in this document. If desired, attacks can be mitigated by performing basic validation checks (such as whether timestamp T2 is later than timestamp T1 in the STAMP Reference Topology shown in , when the Session-Sender and Session-Reflector clocks are synchronized) in Session-Reflector test packets received at the Session-Sender. The minimal state associated with this protocol also limits the extent of measurement disruption that can be caused by a corrupt or invalid test packet to a single test cycle. An attacker can send a forged STAMP test packet to the ingress or egress node of an LSP, causing the STAMP session to be terminated prematurely. To mitigate these threats, operators SHOULD filter STAMP test packets at the edges of the MPLS administrative domain. Furthermore, implementations SHOULD NOT assign SSIDs in a predictable manner. To avoid predictability, implementations can leverage a Cryptographically Secure Pseudorandom Number Generator . The STAMP test packets received via a PW or an LSP are processed in the context of that PW or LSP, and the encapsulations defined in this document do not introduce a mechanism for cross-service OAM interactions.

IANA maintains the G-ACh Type Registry (see ). IANA is requested to allocate values for the G-ACh Types for STAMP from the "MPLS Generalized Associated Channel (G-ACh) Types (including Pseudowire Associated Channel Types)" registry. Value Description Reference TBA1 STAMP Session-Sender G-ACh Type This document TBA2 STAMP Session-Reflector G-ACh Type This document

References &RFC2119; &RFC3032; &RFC4385; &RFC5082; &RFC5085; &RFC5586; &RFC6790; &RFC8174; &RFC8762; &RFC8972; &RFC9780; &RFC2104; &RFC3931; &RFC4026; &RFC4448; &RFC5087; &RFC5462; &RFC5921; &RFC5960; &RFC6374; &RFC6658; &RFC7708; &RFC7820; &RFC6936; &RFC8085; &RFC9801; &I-D.ietf-spring-stamp-srpm-mpls; Recommendation for Random Number Generation Using Deterministic Random Bit Generators, Revision 1 NIST Special Publication 800-90A Revision 1 IANA IPv6 Special-Purpose Address Registry IANA

The authors would like to thank Bharath Vasudevan, Ali Sianati, and Parag Jain for the discussions on the method to punt STAMP test packets to the control plane for processing. The authors would also like to thank Greg Mirsky, Loa Andersson, Li Zhang, Richard Foote (Footer), and Stewart Bryant for reviewing this document and providing useful comments and suggestions. Thanks to Carlos Pignataro for the PerfMetrdir review, Russ White for the early Rtgdir review, Russ Housley for the Gen-ART review, Vidhi Goel for the TSVART review, Giuseppe Fioccola for the Opsdir review, and Yaron Sheffer for the early Secdir review which helped improve this document.