idnits 2.17.1 draft-ietf-ipngwg-icmp-v2-00.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- ** Cannot find the required boilerplate sections (Copyright, IPR, etc.) in this document. Expected boilerplate is as follows today (2024-04-24) according to https://trustee.ietf.org/license-info : IETF Trust Legal Provisions of 28-dec-2009, Section 6.a: This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. IETF Trust Legal Provisions of 28-dec-2009, Section 6.b(i), paragraph 2: Copyright (c) 2024 IETF Trust and the persons identified as the document authors. All rights reserved. IETF Trust Legal Provisions of 28-dec-2009, Section 6.b(i), paragraph 3: This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- ** Missing expiration date. The document expiration date should appear on the first and last page. ** The document seems to lack a 1id_guidelines paragraph about Internet-Drafts being working documents. ** The document seems to lack a 1id_guidelines paragraph about 6 months document validity -- however, there's a paragraph with a matching beginning. Boilerplate error? ** The document seems to lack a 1id_guidelines paragraph about the list of current Internet-Drafts. ** The document seems to lack a 1id_guidelines paragraph about the list of Shadow Directories. == No 'Intended status' indicated for this document; assuming Proposed Standard Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- ** The document seems to lack an IANA Considerations section. (See Section 2.2 of https://www.ietf.org/id-info/checklist for how to handle the case when there are no actions for IANA.) ** The document seems to lack separate sections for Informative/Normative References. All references will be assumed normative when checking for downward references. ** The document seems to lack a both a reference to RFC 2119 and the recommended RFC 2119 boilerplate, even if it appears to use RFC 2119 keywords. RFC 2119 keyword, line 101: '... IPv6 and MUST be fully implemented ...' RFC 2119 keyword, line 195: '... Implementations MUST observe the foll...' RFC 2119 keyword, line 198: '...e of unknown type is received, it MUST...' RFC 2119 keyword, line 202: '... it MUST be silently discarded....' RFC 2119 keyword, line 223: '...v6 error message MUST NOT be sent as a...' (27 more instances...) Miscellaneous warnings: ---------------------------------------------------------------------------- -- The document seems to lack a disclaimer for pre-RFC5378 work, but may have content which was first submitted before 10 November 2008. If you have contacted all the original authors and they are all willing to grant the BCP78 rights to the IETF Trust, then this is fine, and you can ignore this comment. If not, you may need to add the pre-RFC5378 disclaimer. (See the Legal Provisions document at https://trustee.ietf.org/license-info for more information.) -- Couldn't find a document date in the document -- date freshness check skipped. Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) == Missing Reference: 'IPv6-AUTH' is mentioned on line 604, but not defined == Unused Reference: 'IPv6-SA' is defined on line 680, but no explicit reference was found in the text ** Obsolete normative reference: RFC 1883 (ref. 'IPv6') (Obsoleted by RFC 2460) ** Obsolete normative reference: RFC 1884 (ref. 'IPv6-ADDR') (Obsoleted by RFC 2373) ** Obsolete normative reference: RFC 1970 (ref. 'IPv6-DISC') (Obsoleted by RFC 2461) ** Obsolete normative reference: RFC 1981 (Obsoleted by RFC 8201) ** Obsolete normative reference: RFC 1825 (ref. 'IPv6-SA') (Obsoleted by RFC 2401) ** Obsolete normative reference: RFC 1826 (ref. 'IPv6-Auth') (Obsoleted by RFC 2402) ** Obsolete normative reference: RFC 1827 (ref. 'IPv6-ESP') (Obsoleted by RFC 2406) Summary: 16 errors (**), 0 flaws (~~), 3 warnings (==), 2 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 1 INTERNET-DRAFT A. Conta, Lucent 2 October 22, 1997 S. Deering, Cisco Systems 4 Internet Control Message Protocol (ICMPv6) 5 for the Internet Protocol Version 6 (IPv6) 6 Specification 8 10 Status of this Memo 12 This document is an Internet-Draft. Internet-Drafts are working 13 documents of the Internet Engineering Task Force (IETF), its areas, 14 and its working groups. Note that other groups may also distribute 15 working documents as Internet-Drafts. 17 Internet-Drafts are draft documents valid for a maximum of six months 18 and may be updated, replaced, or obsoleted by other documents at any 19 time. It is inappropriate to use Internet- Drafts as reference 20 material or to cite them other than as "work in progress." 22 To learn the current status of any Internet-Draft, please check the 23 "1id-abstracts.txt" listing contained in the Internet- Drafts Shadow 24 Directories on ds.internic.net (US East Coast), nic.nordu.net 25 (Europe), ftp.isi.edu (US West Coast), or munnari.oz.au (Pacific 26 Rim). 28 This Internet Draft expires April 22, 1998. 30 Abstract 32 This document specifies a set of Internet Control Message Protocol 33 (ICMP) messages for use with version 6 of the Internet Protocol 34 (IPv6). 36 Table of Contents 38 1. Introduction........................................3 40 2. ICMPv6 (ICMP for IPv6)..............................3 42 2.1 Message General Format.......................3 44 2.2 Message Source Address Determination.........4 46 2.3 Message Checksum Calculation.................5 48 2.4 Message Processing Rules.....................5 50 3. ICMPv6 Error Messages...............................8 52 3.1 Destination Unreachable Message..............8 54 3.2 Packet Too Big Message......................10 56 3.3 Time Exceeded Message.......................11 58 3.4 Parameter Problem Message...................12 60 4. ICMPv6 Informational Messages......................14 62 4.1 Echo Request Message........................14 64 4.2 Echo Reply Message..........................15 66 5. Security Considerations............................17 68 6. References.........................................19 70 7. Acknowledgments....................................19 72 8. Authors' Addresses.................................20 74 Appendix A - Changes since RFC 1885 76 1. Introduction 78 The Internet Protocol, version 6 (IPv6) is a new version of IP. IPv6 79 uses the Internet Control Message Protocol (ICMP) as defined for IPv4 80 [RFC-792], with a number of changes. The resulting protocol is 81 called ICMPv6, and has an IPv6 Next Header value of 58. 83 This document describes the format of a set of control messages used 84 in ICMPv6. It does not describe the procedures for using these 85 messages to achieve functions like Path MTU discovery ; such 86 procedures are described in other documents (e.g., [RFC-1981]). 87 Other documents may also introduce additional ICMPv6 message types, 88 such as Neighbor Discovery messages [IPv6-DISC], subject to the 89 general rules for ICMPv6 messages given in section 2 of this 90 document. 92 Terminology defined in the IPv6 specification [IPv6] and the IPv6 93 Routing and Addressing specification [IPv6-ADDR] applies to this 94 document as well. 96 2. ICMPv6 (ICMP for IPv6) 98 ICMPv6 is used by IPv6 nodes to report errors encountered in 99 processing packets, and to perform other internet-layer functions, 100 such as diagnostics (ICMPv6 "ping"). ICMPv6 is an integral part of 101 IPv6 and MUST be fully implemented by every IPv6 node. 103 2.1 Message General Format 105 ICMPv6 messages are grouped into two classes: error messages and 106 informational messages. Error messages are identified as such by 107 having a zero in the high-order bit of their message Type field 108 values. Thus, error messages have message Types from 0 to 127; 109 informational messages have message Types from 128 to 255. 111 This document defines the message formats for the following ICMPv6 112 messages: 114 ICMPv6 error messages: 116 1 Destination Unreachable (see section 3.1) 117 2 Packet Too Big (see section 3.2) 118 3 Time Exceeded (see section 3.3) 119 4 Parameter Problem (see section 3.4) 121 ICMPv6 informational messages: 123 128 Echo Request (see section 4.1) 124 129 Echo Reply (see section 4.2) 126 Every ICMPv6 message is preceded by an IPv6 header and zero or more 127 IPv6 extension headers. The ICMPv6 header is identified by a Next 128 Header value of 58 in the immediately preceding header. (NOTE: this 129 is different than the value used to identify ICMP for IPv4.) 131 The ICMPv6 messages have the following general format: 133 0 1 2 3 134 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 135 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 136 | Type | Code | Checksum | 137 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 138 | | 139 + Message Body + 140 | | 142 The type field indicates the type of the message. Its value 143 determines the format of the remaining data. 145 The code field depends on the message type. It is used to create an 146 additional level of message granularity. 148 The checksum field is used to detect data corruption in the ICMPv6 149 message and parts of the IPv6 header. 151 2.2 Message Source Address Determination 153 A node that sends an ICMPv6 message has to determine both the Source 154 and Destination IPv6 Addresses in the IPv6 header before calculating 155 the checksum. If the node has more than one unicast address, it must 156 choose the Source Address of the message as follows: 158 (a) If the message is a response to a message sent to one of the 159 node's unicast addresses, the Source Address of the reply must 160 be that same address. 162 (b) If the message is a response to a message sent to a multicast or 163 anycast group in which the node is a member, the Source Address 164 of the reply must be a unicast address belonging to the 165 interface on which the multicast or anycast packet was received. 167 (c) If the message is a response to a message sent to an address 168 that does not belong to the node, the Source Address should be 169 that unicast address belonging to the node that will be most 170 helpful in diagnosing the error. For example, if the message is 171 a response to a packet forwarding action that cannot complete 172 successfully, the Source Address should be a unicast address 173 belonging to the interface on which the packet forwarding 174 failed. 176 (d) Otherwise, the node's routing table must be examined to 177 determine which interface will be used to transmit the message 178 to its destination, and a unicast address belonging to that 179 interface must be used as the Source Address of the message. 181 2.3 Message Checksum Calculation 183 The checksum is the 16-bit one's complement of the one's complement 184 sum of the entire ICMPv6 message starting with the ICMPv6 message 185 type field, prepended with a "pseudo-header" of IPv6 header fields, 186 as specified in [IPv6, section 8.1]. The Next Header value used in 187 the pseudo-header is 58. (NOTE: the inclusion of a pseudo-header in 188 the ICMPv6 checksum is a change from IPv4; see [IPv6] for the 189 rationale for this change.) 191 For computing the checksum, the checksum field is set to zero. 193 2.4 Message Processing Rules 195 Implementations MUST observe the following rules when processing 196 ICMPv6 messages (from [RFC-1122]): 198 (a) If an ICMPv6 error message of unknown type is received, it MUST 199 be passed to the upper layer. 201 (b) If an ICMPv6 informational message of unknown type is received, 202 it MUST be silently discarded. 204 (c) Every ICMPv6 error message (type < 128) includes as much of the 205 IPv6 offending (invoking) packet (the packet that caused the 206 error) as will fit without making the error message packet 207 exceed 576 octets. 209 (d) In those cases where the internet-layer protocol is required to 210 pass an ICMPv6 error message to the upper-layer protocol, the 211 upper-layer protocol type is extracted from the original packet 212 (contained in the body of the ICMPv6 error message) and used to 213 select the appropriate upper-layer protocol entity to handle the 214 error. 216 If the original packet had an unusually large amount of 217 extension headers, it is possible that the upper-layer protocol 218 type may not be present in the ICMPv6 message, due to truncation 219 of the original packet to meet the 576-octet limit. In that 220 case, the error message is silently dropped after any IPv6-layer 221 processing. 223 (e) An ICMPv6 error message MUST NOT be sent as a result of 224 receiving: 226 (e.1) an ICMPv6 error message, or 228 (e.2) a packet destined to an IPv6 multicast address (there are 229 two exceptions to this rule: (1) the Packet Too Big 230 Message - Section 3.2 - to allow Path MTU discovery to 231 work for IPv6 multicast, and (2) the Parameter Problem 232 Message, Code 2 - Section 3.4 - reporting an unrecognized 233 IPv6 option that has the Option Type highest-order two 234 bits set to 10), or 236 (e.3) a packet sent as a link-layer multicast, (the exception 237 from e.2 applies to this case too), or 239 (e.4) a packet sent as a link-layer broadcast, (the exception 240 from e.2 applies to this case too), or 242 (e.5) a packet whose source address does not uniquely identify 243 a single node -- e.g., the IPv6 Unspecified Address, an 244 IPv6 multicast address, or an address known by the ICMP 245 message sender to be an IPv6 anycast address. 247 (f) Finally, to each sender of informational requests and erroneous 248 data packet, an IPv6 node MUST limit the rate of informational 249 replies and ICMPv6 error messages sent, in order to limit the 250 bandwidth and forwarding costs incurred by these messages when a 251 generator of these messages is sending too many and/or sending 252 erroneous packets and does not respond to those error messages 253 by ceasing its transmissions. There are a variety of ways of 254 implementing the rate-limiting function, for example: 256 (f.1) Timer-based - for example, limiting the rate of 257 transmission of informational reply or error messages to 258 a given source, or to any source, to at most once every T 259 milliseconds. 261 (f.2) Bandwidth-based - for example, limiting the rate at 262 which informational reply or error messages are sent from 263 a particular interface to some fraction F of the attached 264 link's bandwidth. 266 The limit parameters (e.g., T or F in the above examples) MUST 267 be configurable for the node, with a conservative default value 268 (e.g., T = 1 second, NOT 0 seconds, or F = 2 percent, NOT 100 269 percent). 271 The following sections describe the message formats for the above 272 ICMPv6 messages. 274 3. ICMPv6 Error Messages 276 3.1 Destination Unreachable Message 278 0 1 2 3 279 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 280 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 281 | Type | Code | Checksum | 282 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 283 | Unused | 284 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 285 | As much of invoking packet | 286 + as will fit without the ICMPv6 packet + 287 | exceeding 576 octets | 289 IPv6 Fields: 291 Destination Address 293 Copied from the Source Address field of the invoking 294 packet. 296 ICMPv6 Fields: 298 Type 1 300 Code 0 - no route to destination 301 1 - communication with destination 302 administratively prohibited 303 2 - not a neighbor 304 3 - address unreachable 305 4 - port unreachable 307 Unused This field is unused for all code values. 308 It must be initialized to zero by the sender 309 and ignored by the receiver. 310 Description 312 A Destination Unreachable message SHOULD be generated by a router, or 313 by the IPv6 layer in the originating node, in response to a packet 314 that cannot be delivered to its destination address for reasons other 315 than congestion. (An ICMPv6 message MUST NOT be generated if a 316 packet is dropped due to congestion.) 318 If the reason for the failure to deliver is lack of a matching entry 319 in the forwarding node's routing table, the Code field is set to 0 320 (NOTE: this error can occur only in nodes that do not hold a "default 321 route" in their routing tables). 323 If the reason for the failure to deliver is administrative 324 prohibition, e.g., a "firewall filter", the Code field is set to 1. 326 If the reason for the failure to deliver is that the next destination 327 address in the Routing header is not a neighbor of the processing 328 node but the "strict" bit is set for that address, then the Code 329 field is set to 2. 331 If there is any other reason for the failure to deliver, e.g., 332 inability to resolve the IPv6 destination address into a 333 corresponding link address, or a link-specific problem of some sort, 334 then the Code field is set to 3. 336 A destination node SHOULD send a Destination Unreachable message with 337 Code 4 in response to a packet for which the transport protocol 338 (e.g., UDP) has no listener, if that transport protocol has no 339 alternative means to inform the sender. 341 Upper layer notification 343 A node receiving the ICMPv6 Destination Unreachable message MUST 344 notify the upper-layer protocol. 346 3.2 Packet Too Big Message 348 0 1 2 3 349 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 350 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 351 | Type | Code | Checksum | 352 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 353 | MTU | 354 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 355 | As much of invoking packet | 356 + as will fit without the ICMPv6 packet + 357 | exceeding 576 octets | 359 IPv6 Fields: 361 Destination Address 363 Copied from the Source Address field of the invoking 364 packet. 366 ICMPv6 Fields: 368 Type 2 370 Code 0 372 MTU The Maximum Transmission Unit of the next-hop link. 374 Description 376 A Packet Too Big MUST be sent by a router in response to a packet 377 that it cannot forward because the packet is larger than the MTU of 378 the outgoing link. The information in this message is used as part 379 of the Path MTU Discovery process [RFC-1981]. 381 Sending a Packet Too Big Message makes an exception to one of the 382 rules of when to send an ICMPv6 error message, in that unlike other 383 messages, it is sent in response to a packet received with an IPv6 384 multicast destination address, or a link-layer multicast or link- 385 layer broadcast address. 387 Upper layer notification 389 An incoming Packet Too Big message MUST be passed to the upper-layer 390 protocol. 392 3.3 Time Exceeded Message 394 0 1 2 3 395 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 396 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 397 | Type | Code | Checksum | 398 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 399 | Unused | 400 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 401 | As much of invoking packet | 402 + as will fit without the ICMPv6 packet + 403 | exceeding 576 octets | 405 IPv6 Fields: 407 Destination Address 408 Copied from the Source Address field of the invoking 409 packet. 411 ICMPv6 Fields: 413 Type 3 415 Code 0 - hop limit exceeded in transit 417 1 - fragment reassembly time exceeded 419 Unused This field is unused for all code values. 420 It must be initialized to zero by the sender 421 and ignored by the receiver. 423 Description 425 If a router receives a packet with a Hop Limit of zero, or a router 426 decrements a packet's Hop Limit to zero, it MUST discard the packet 427 and send an ICMPv6 Time Exceeded message with Code 0 to the source of 428 the packet. This indicates either a routing loop or too small an 429 initial Hop Limit value. 431 The rules for selecting the Source Address of this message are 432 defined in section 2.2. 434 Upper layer notification 436 An incoming Time Exceeded message MUST be passed to the upper-layer 437 protocol. 439 3.4 Parameter Problem Message 441 0 1 2 3 442 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 443 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 444 | Type | Code | Checksum | 445 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 446 | Pointer | 447 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 448 | As much of invoking packet | 449 + as will fit without the ICMPv6 packet + 450 | exceeding 576 octets | 452 IPv6 Fields: 454 Destination Address 456 Copied from the Source Address field of the invoking 457 packet. 459 ICMPv6 Fields: 461 Type 4 463 Code 0 - erroneous header field encountered 465 1 - unrecognized Next Header type encountered 467 2 - unrecognized IPv6 option encountered 469 Pointer Identifies the octet offset within the 470 invoking packet where the error was detected. 472 The pointer will point beyond the end of the ICMPv6 473 packet if the field in error is beyond what can fit 474 in the 576-byte limit of an ICMPv6 error message. 476 Description 478 If an IPv6 node processing a packet finds a problem with a field in 479 the IPv6 header or extension headers such that it cannot complete 480 processing the packet, it MUST discard the packet and SHOULD send an 481 ICMPv6 Parameter Problem message to the packet's source, indicating 482 the type and location of the problem. 484 The pointer identifies the octet of the original packet's header 485 where the error was detected. For example, an ICMPv6 message with 486 Type field = 4, Code field = 1, and Pointer field = 40 would indicate 487 that the IPv6 extension header following the IPv6 header of the 488 original packet holds an unrecognized Next Header field value. 490 Upper layer notification 492 A node receiving this ICMPv6 message MUST notify the upper-layer 493 protocol. 495 4. ICMPv6 Informational Messages 497 4.1 Echo Request Message 499 0 1 2 3 500 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 501 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 502 | Type | Code | Checksum | 503 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 504 | Identifier | Sequence Number | 505 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 506 | Data ... 507 +-+-+-+-+- 509 IPv6 Fields: 511 Destination Address 513 Any legal IPv6 address. 515 ICMPv6 Fields: 517 Type 128 519 Code 0 521 Identifier An identifier to aid in matching Echo Replies 522 to this Echo Request. May be zero. 524 Sequence Number 526 A sequence number to aid in matching Echo Replies 527 to this Echo Request. May be zero. 529 Data Zero or more octets of arbitrary data. 531 Description 533 Every node MUST implement an ICMPv6 Echo responder function that 534 receives Echo Requests and sends corresponding Echo Replies. A node 535 SHOULD also implement an application-layer interface for sending Echo 536 Requests and receiving Echo Replies, for diagnostic purposes. 538 Upper layer notification 540 A node receiving this ICMPv6 message MAY notify the upper-layer 541 protocol. 543 4.2 Echo Reply Message 545 0 1 2 3 546 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 547 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 548 | Type | Code | Checksum | 549 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 550 | Identifier | Sequence Number | 551 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 552 | Data ... 553 +-+-+-+-+- 555 IPv6 Fields: 557 Destination Address 559 Copied from the Source Address field of the invoking 560 Echo Request packet. 562 ICMPv6 Fields: 564 Type 129 566 Code 0 568 Identifier The identifier from the invoking Echo Request message. 570 Sequence The sequence number from the invoking Echo Request 571 Number message. 573 Data The data from the invoking Echo Request message. 575 Description 577 Every node MUST implement an ICMPv6 Echo responder function that 578 receives Echo Requests and sends corresponding Echo Replies. A node 579 SHOULD also implement an application-layer interface for sending Echo 580 Requests and receiving Echo Replies, for diagnostic purposes. 582 The source address of an Echo Reply sent in response to a unicast 583 Echo Request message MUST be the same as the destination address of 584 that Echo Request message. 586 An Echo Reply SHOULD be sent in response to an Echo Request message 587 sent to an IPv6 multicast address. The source address of the reply 588 MUST be a unicast address belonging to the interface on which the 589 multicast Echo Request message was received. 591 The data received in the ICMPv6 Echo Request message MUST be returned 592 entirely and unmodified in the ICMPv6 Echo Reply message. 594 Upper layer notification 596 Echo Reply messages MUST be passed to the ICMPv6 user interface, 597 unless the corresponding Echo Request originated in the IP layer. 599 5. Security Considerations 601 5.1 Authentication and Encryption of ICMP messages 603 ICMP protocol packet exchanges can be authenticated using the IP 604 Authentication Header [IPv6-AUTH]. A node SHOULD include an 605 Authentication Header when sending ICMP messages if a security 606 association for use with the IP Authentication Header exists for the 607 destination address. The security associations may have been created 608 through manual configuration or through the operation of some key 609 management protocol. 611 Received Authentication Headers in ICMP packets MUST be verified for 612 correctness and packets with incorrect authentication MUST be ignored 613 and discarded. 615 It SHOULD be possible for the system administrator to configure a 616 node to ignore any ICMP messages that are not authenticated using 617 either the Authentication Header or Encapsulating Security Payload. 618 Such a switch SHOULD default to allowing unauthenticated messages. 620 Confidentiality issues are addressed by the IP Security Architecture 621 and the IP Encapsulating Security Payload documents [IPv6-SA, 622 IPv6-ESP]. 624 5.2 ICMP Attacks 626 ICMP messages may be subject to various attacks. The following is a 627 discussion of such attacks and their prevention: 629 1. ICMP messages may be subject to actions intended to cause the 630 receiver believe the message came from a different source than the 631 message originator. The protection against this attack can be 632 achieved by applying the IPv6 Authentication mechanism [IPv6-Auth] 633 to the ICMP message. 635 2. ICMP messages may be subject to actions intended to cause the 636 message or the reply to it go to a destination different than the 637 message originator's intention. The ICMP checksum calculation 638 provides a protection mechanism against changes by a malicious 639 interceptor in the destination and source address of the IP packet 640 carrying that message, provided the ICMP checksum field is 641 protected against change by the encryption [IPv6-ESP] of the ICMP 642 message. 644 3. ICMP messages may be subject to changes in the message fields, or 645 payload. The encryption [IPv6-ESP] of the ICMP message is a 646 protection against such actions. 648 4. ICMP messages may be used as attempts to perform denial of service 649 attacks by sending back to back erroneous IP packets. An 650 implementation that correctly followed section 2.4, paragraph (f) 651 of this specifications, would be protected by the ICMP error rate 652 limiting mechanism. 654 5. ICMP messages may be used as attempts to perform denial of service 655 attacks by sending back to back ICMP "echo" messages that cause 656 the generation of back to back ICMP "echo reply" messages. An 657 implementation that correctly followed section 2.4, paragraph (f) 658 of this specifications, would be protected by the ICMP rate 659 limiting mechanism. 661 6. References 663 [IPv6] Deering, S., R. Hinden, "Internet Protocol, Version 6, 664 Specification", RFC1883, December 1995. 666 [IPv6-ADDR] Hinden, R., S. Deering, "IP Version 6 Addressing 667 Architecture", RFC1884, December 1995. 669 [IPv6-DISC] Narten, T., E. Nordmark, W. Simpson, "Neighbor Discovery 670 for IP Version 6 (IPv6)", RFC1970, August 1996. 672 [RFC-792] Postel, J., "Internet Control Message Protocol", RFC792. 674 [RFC-1122] Braden, R., "Requirements for Internet Hosts - 675 Communication Layers", RFC1122. 677 [RFC-1981] McCann, J., S. Deering, J. Mogul, "Path MTU Discovery 678 for IP version 6", RFC1981, August 1996. 680 [IPv6-SA] Atkinson, R., Security Architecture for the Internet 681 Protocol, RFC-1825, August 1995. 683 [IPv6-Auth] Atkinson, R., IP Authentication Header, RFC-1826, August 684 1995. 686 [IPv6-ESP] Atkinson, R., IP Encapsulating Security Protocol (ESP), 687 RFC-1827, August 1995. 689 7. Acknowledgments 691 The document is derived from previous ICMP drafts of the SIPP and 692 IPng working group. 694 The IPng working group and particularly Robert Elz, Jim Bound, Bill 695 Simpson, Thomas Narten, Charlie Lynn, Bill Fink, Scott Bradner, 696 Dimitri Haskin, and Bob Hinden (in chronological order) provided 697 extensive review information and feedback. 699 8. Authors' Addresses 701 Alex Conta Stephen Deering 702 Lucent Technologies Inc. Cisco Systems, Inc. 703 300 Baker Ave, Suite 100 170 West Tasman Drive 704 Concord, MA 01742 San Jose, CA 95134-1706 705 USA USA 707 phone: +1 508 287-2842 phone: +1 408 527-8213 708 email: aconta@lucent.com email: deering@parc.xerox.com 710 Appendix A - Changes since RFC 1885 712 - Remove section 2.4 on Group Management ICMP messages 713 - Remove references to IGMP in Abstract and Section 1. 714 - Update references to other IPv6 documents 715 - Remove references to RFC-1112 in Abstract, and Section 1, and to 716 RFC-1191 in section 1, and section 3.2 717 - Add security section 718 - Add Appendix A - changes