idnits 2.17.1 draft-ietf-ipngwg-icmp-v2-01.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- ** Cannot find the required boilerplate sections (Copyright, IPR, etc.) in this document. Expected boilerplate is as follows today (2024-04-26) according to https://trustee.ietf.org/license-info : IETF Trust Legal Provisions of 28-dec-2009, Section 6.a: This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. IETF Trust Legal Provisions of 28-dec-2009, Section 6.b(i), paragraph 2: Copyright (c) 2024 IETF Trust and the persons identified as the document authors. All rights reserved. IETF Trust Legal Provisions of 28-dec-2009, Section 6.b(i), paragraph 3: This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- ** Missing expiration date. The document expiration date should appear on the first and last page. ** The document seems to lack a 1id_guidelines paragraph about Internet-Drafts being working documents. ** The document seems to lack a 1id_guidelines paragraph about the list of current Internet-Drafts. ** The document seems to lack a 1id_guidelines paragraph about the list of Shadow Directories. == No 'Intended status' indicated for this document; assuming Proposed Standard Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- ** The document seems to lack an IANA Considerations section. (See Section 2.2 of https://www.ietf.org/id-info/checklist for how to handle the case when there are no actions for IANA.) ** The document seems to lack separate sections for Informative/Normative References. All references will be assumed normative when checking for downward references. Miscellaneous warnings: ---------------------------------------------------------------------------- -- The document seems to lack a disclaimer for pre-RFC5378 work, but may have content which was first submitted before 10 November 2008. If you have contacted all the original authors and they are all willing to grant the BCP78 rights to the IETF Trust, then this is fine, and you can ignore this comment. If not, you may need to add the pre-RFC5378 disclaimer. (See the Legal Provisions document at https://trustee.ietf.org/license-info for more information.) -- Couldn't find a document date in the document -- date freshness check skipped. Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) == Missing Reference: 'IPv6-AUTH' is mentioned on line 602, but not defined == Unused Reference: 'IPv6-SA' is defined on line 682, but no explicit reference was found in the text -- Possible downref: Non-RFC (?) normative reference: ref. 'IPv6' ** Obsolete normative reference: RFC 2373 (ref. 'IPv6-ADDR') (Obsoleted by RFC 3513) -- Possible downref: Non-RFC (?) normative reference: ref. 'IPv6-DISC' ** Obsolete normative reference: RFC 1981 (ref. 'PMTU') (Obsoleted by RFC 8201) -- Possible downref: Non-RFC (?) normative reference: ref. 'IPv6-SA' -- Possible downref: Non-RFC (?) normative reference: ref. 'IPv6-Auth' -- Possible downref: Non-RFC (?) normative reference: ref. 'IPv6-ESP' Summary: 9 errors (**), 0 flaws (~~), 3 warnings (==), 7 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 1 INTERNET-DRAFT A. Conta, Lucent 2 August 5, 1998 S. Deering, Cisco Systems 4 Internet Control Message Protocol (ICMPv6) 5 for the Internet Protocol Version 6 (IPv6) 6 Specification 8 10 Status of this Memo 12 This document is an Internet-Draft. Internet-Drafts are working 13 documents of the Internet Engineering Task Force (IETF), its areas, 14 and its working groups. Note that other groups may also distribute 15 working documents as Internet-Drafts. 17 Internet-Drafts are draft documents valid for a maximum of six months 18 and may be updated, replaced, or obsoleted by other documents at any 19 time. It is inappropriate to use Internet-Drafts as reference 20 material or to cite them other than as "work in progress." 22 To view the entire list of current Internet-Drafts, please check the 23 "1id-abstracts.txt" listing contained in the Internet-Drafts Shadow 24 Directories on ftp.is.co.za (Africa), ftp.nordu.net (Northern 25 Europe), ftp.nis.garr.it (Southern Europe), munnari.oz.au (Pacific 26 Rim), ftp.ietf.org (US East Coast), or ftp.isi.edu (US West Coast). 28 This Internet Draft expires February 5, 1999. 30 Abstract 32 This document specifies a set of Internet Control Message Protocol 33 (ICMP) messages for use with version 6 of the Internet Protocol 34 (IPv6). 36 Table of Contents 38 1. Introduction........................................3 40 2. ICMPv6 (ICMP for IPv6)..............................3 42 2.1 Message General Format.......................3 44 2.2 Message Source Address Determination.........4 46 2.3 Message Checksum Calculation.................5 48 2.4 Message Processing Rules.....................5 50 3. ICMPv6 Error Messages...............................8 52 3.1 Destination Unreachable Message..............8 54 3.2 Packet Too Big Message......................10 56 3.3 Time Exceeded Message.......................11 58 3.4 Parameter Problem Message...................12 60 4. ICMPv6 Informational Messages......................14 62 4.1 Echo Request Message........................14 64 4.2 Echo Reply Message..........................15 66 5. Security Considerations............................17 68 6. References.........................................19 70 7. Acknowledgments....................................19 72 8. Authors' Addresses.................................20 74 Appendix A - Changes since RFC 1885...................20 76 1. Introduction 78 The Internet Protocol, version 6 (IPv6) is a new version of IP. IPv6 79 uses the Internet Control Message Protocol (ICMP) as defined for IPv4 80 [RFC-792], with a number of changes. The resulting protocol is 81 called ICMPv6, and has an IPv6 Next Header value of 58. 83 This document describes the format of a set of control messages used 84 in ICMPv6. It does not describe the procedures for using these 85 messages to achieve functions like Path MTU discovery; such 86 procedures are described in other documents (e.g., [PMTU]). Other 87 documents may also introduce additional ICMPv6 message types, such as 88 Neighbor Discovery messages [IPv6-DISC], subject to the general rules 89 for ICMPv6 messages given in section 2 of this document. 91 Terminology defined in the IPv6 specification [IPv6] and the IPv6 92 Routing and Addressing specification [IPv6-ADDR] applies to this 93 document as well. 95 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 96 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 97 document are to be interpreted as described in [RFC-2119]. 99 2. ICMPv6 (ICMP for IPv6) 101 ICMPv6 is used by IPv6 nodes to report errors encountered in 102 processing packets, and to perform other internet-layer functions, 103 such as diagnostics (ICMPv6 "ping"). ICMPv6 is an integral part of 104 IPv6 and MUST be fully implemented by every IPv6 node. 106 2.1 Message General Format 108 ICMPv6 messages are grouped into two classes: error messages and 109 informational messages. Error messages are identified as such by 110 having a zero in the high-order bit of their message Type field 111 values. Thus, error messages have message Types from 0 to 127; 112 informational messages have message Types from 128 to 255. 114 This document defines the message formats for the following ICMPv6 115 messages: 117 ICMPv6 error messages: 119 1 Destination Unreachable (see section 3.1) 120 2 Packet Too Big (see section 3.2) 121 3 Time Exceeded (see section 3.3) 122 4 Parameter Problem (see section 3.4) 124 ICMPv6 informational messages: 126 128 Echo Request (see section 4.1) 127 129 Echo Reply (see section 4.2) 129 Every ICMPv6 message is preceded by an IPv6 header and zero or more 130 IPv6 extension headers. The ICMPv6 header is identified by a Next 131 Header value of 58 in the immediately preceding header. (NOTE: this 132 is different than the value used to identify ICMP for IPv4.) 134 The ICMPv6 messages have the following general format: 136 0 1 2 3 137 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 138 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 139 | Type | Code | Checksum | 140 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 141 | | 142 + Message Body + 143 | | 145 The type field indicates the type of the message. Its value 146 determines the format of the remaining data. 148 The code field depends on the message type. It is used to create an 149 additional level of message granularity. 151 The checksum field is used to detect data corruption in the ICMPv6 152 message and parts of the IPv6 header. 154 2.2 Message Source Address Determination 156 A node that sends an ICMPv6 message has to determine both the Source 157 and Destination IPv6 Addresses in the IPv6 header before calculating 158 the checksum. If the node has more than one unicast address, it must 159 choose the Source Address of the message as follows: 161 (a) If the message is a response to a message sent to one of the 162 node's unicast addresses, the Source Address of the reply must 163 be that same address. 165 (b) If the message is a response to a message sent to a multicast or 166 anycast group in which the node is a member, the Source Address 167 of the reply must be a unicast address belonging to the 168 interface on which the multicast or anycast packet was received. 170 (c) If the message is a response to a message sent to an address 171 that does not belong to the node, the Source Address should be 172 that unicast address belonging to the node that will be most 173 helpful in diagnosing the error. For example, if the message is 174 a response to a packet forwarding action that cannot complete 175 successfully, the Source Address should be a unicast address 176 belonging to the interface on which the packet forwarding 177 failed. 179 (d) Otherwise, the node's routing table must be examined to 180 determine which interface will be used to transmit the message 181 to its destination, and a unicast address belonging to that 182 interface must be used as the Source Address of the message. 184 2.3 Message Checksum Calculation 186 The checksum is the 16-bit one's complement of the one's complement 187 sum of the entire ICMPv6 message starting with the ICMPv6 message 188 type field, prepended with a "pseudo-header" of IPv6 header fields, 189 as specified in [IPv6, section 8.1]. The Next Header value used in 190 the pseudo-header is 58. (NOTE: the inclusion of a pseudo-header in 191 the ICMPv6 checksum is a change from IPv4; see [IPv6] for the 192 rationale for this change.) 194 For computing the checksum, the checksum field is set to zero. 196 2.4 Message Processing Rules 198 Implementations MUST observe the following rules when processing 199 ICMPv6 messages (from [RFC-1122]): 201 (a) If an ICMPv6 error message of unknown type is received, it MUST 202 be passed to the upper layer. 204 (b) If an ICMPv6 informational message of unknown type is received, 205 it MUST be silently discarded. 207 (c) Every ICMPv6 error message (type < 128) includes as much of the 208 IPv6 offending (invoking) packet (the packet that caused the 209 error) as will fit without making the error message packet 210 exceed the minimum IPv6 MTU [IPv6]. 212 (d) In those cases where the internet-layer protocol is required to 213 pass an ICMPv6 error message to the upper-layer protocol, the 214 upper-layer protocol type is extracted from the original packet 215 (contained in the body of the ICMPv6 error message) and used to 216 select the appropriate upper-layer protocol entity to handle the 217 error. 219 If the original packet had an unusually large amount of 220 extension headers, it is possible that the upper-layer protocol 221 type may not be present in the ICMPv6 message, due to truncation 222 of the original packet to meet the minimum IPv6 MTU [IPv6] 223 limit. In that case, the error message is silently dropped 224 after any IPv6-layer processing. 226 (e) An ICMPv6 error message MUST NOT be sent as a result of 227 receiving: 229 (e.1) an ICMPv6 error message, or 231 (e.2) a packet destined to an IPv6 multicast address (there are 232 two exceptions to this rule: (1) the Packet Too Big 233 Message - Section 3.2 - to allow Path MTU discovery to 234 work for IPv6 multicast, and (2) the Parameter Problem 235 Message, Code 2 - Section 3.4 - reporting an unrecognized 236 IPv6 option that has the Option Type highest-order two 237 bits set to 10), or 239 (e.3) a packet sent as a link-layer multicast, (the exception 240 from e.2 applies to this case too), or 242 (e.4) a packet sent as a link-layer broadcast, (the exception 243 from e.2 applies to this case too), or 245 (e.5) a packet whose source address does not uniquely identify 246 a single node -- e.g., the IPv6 Unspecified Address, an 247 IPv6 multicast address, or an address known by the ICMP 248 message sender to be an IPv6 anycast address. 250 (f) Finally, in order to limit the bandwidth and forwarding costs 251 incurred sending ICMPv6 error messages, an IPv6 node MUST limit 252 the rate of ICMPv6 error messages it sends. This situation may 253 occur when the sender of the packets that generate the ICMPv6 254 error messages is sending to many packets and/or packets with 255 errors, and does not cease its transmissions in response to 256 these ICMPv6 error messages. There are a variety of ways of 257 implementing the rate-limiting function, for example: 259 (f.1) Timer-based - for example, limiting the rate of 260 transmission of error messages to a given source, or to 261 any source, to at most once every T milliseconds. 263 (f.2) Bandwidth-based - for example, limiting the rate at which 264 informational reply or error messages are sent from a 265 particular interface to some fraction F of the attached 266 link's bandwidth. 268 The limit parameters (e.g., T or F in the above examples) MUST 269 be configurable for the node, with a conservative default value 270 (e.g., T = 1 second, NOT 0 seconds, or F = 2 percent, NOT 100 271 percent). 273 The following sections describe the message formats for the above 274 ICMPv6 messages. 276 3. ICMPv6 Error Messages 278 3.1 Destination Unreachable Message 280 0 1 2 3 281 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 282 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 283 | Type | Code | Checksum | 284 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 285 | Unused | 286 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 287 | As much of invoking packet | 288 + as will fit without the ICMPv6 packet + 289 | exceeding the minimum IPv6 MTU [IPv6] | 291 IPv6 Fields: 293 Destination Address 295 Copied from the Source Address field of the invoking 296 packet. 298 ICMPv6 Fields: 300 Type 1 302 Code 0 - no route to destination 303 1 - communication with destination 304 administratively prohibited 305 2 - (not assigned) 306 3 - address unreachable 307 4 - port unreachable 309 Unused This field is unused for all code values. 310 It must be initialized to zero by the sender 311 and ignored by the receiver. 312 Description 314 A Destination Unreachable message SHOULD be generated by a router, or 315 by the IPv6 layer in the originating node, in response to a packet 316 that cannot be delivered to its destination address for reasons other 317 than congestion. (An ICMPv6 message MUST NOT be generated if a 318 packet is dropped due to congestion.) 320 If the reason for the failure to deliver is lack of a matching entry 321 in the forwarding node's routing table, the Code field is set to 0 322 (NOTE: this error can occur only in nodes that do not hold a "default 323 route" in their routing tables). 325 If the reason for the failure to deliver is administrative 326 prohibition, e.g., a "firewall filter", the Code field is set to 1. 328 If there is any other reason for the failure to deliver, e.g., 329 inability to resolve the IPv6 destination address into a 330 corresponding link address, or a link-specific problem of some sort, 331 then the Code field is set to 3. 333 A destination node SHOULD send a Destination Unreachable message with 334 Code 4 in response to a packet for which the transport protocol 335 (e.g., UDP) has no listener, if that transport protocol has no 336 alternative means to inform the sender. 338 Upper layer notification 340 A node receiving the ICMPv6 Destination Unreachable message MUST 341 notify the upper-layer protocol. 343 3.2 Packet Too Big Message 345 0 1 2 3 346 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 347 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 348 | Type | Code | Checksum | 349 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 350 | MTU | 351 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 352 | As much of invoking packet | 353 + as will fit without the ICMPv6 packet + 354 | exceeding the minimum IPv6 MTU [IPv6] | 356 IPv6 Fields: 358 Destination Address 360 Copied from the Source Address field of the invoking 361 packet. 363 ICMPv6 Fields: 365 Type 2 367 Code Set to 0 (zero) by the sender and ignored by the 368 receiver 370 MTU The Maximum Transmission Unit of the next-hop link. 372 Description 374 A Packet Too Big MUST be sent by a router in response to a packet 375 that it cannot forward because the packet is larger than the MTU of 376 the outgoing link. The information in this message is used as part 377 of the Path MTU Discovery process [PMTU]. 379 Sending a Packet Too Big Message makes an exception to one of the 380 rules of when to send an ICMPv6 error message, in that unlike other 381 messages, it is sent in response to a packet received with an IPv6 382 multicast destination address, or a link-layer multicast or link- 383 layer broadcast address. 385 Upper layer notification 387 An incoming Packet Too Big message MUST be passed to the upper-layer 388 protocol. 390 3.3 Time Exceeded Message 392 0 1 2 3 393 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 394 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 395 | Type | Code | Checksum | 396 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 397 | Unused | 398 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 399 | As much of invoking packet | 400 + as will fit without the ICMPv6 packet + 401 | exceeding the minimum IPv6 MTU [IPv6] | 403 IPv6 Fields: 405 Destination Address 406 Copied from the Source Address field of the invoking 407 packet. 409 ICMPv6 Fields: 411 Type 3 413 Code 0 - hop limit exceeded in transit 415 1 - fragment reassembly time exceeded 417 Unused This field is unused for all code values. 418 It must be initialized to zero by the sender 419 and ignored by the receiver. 421 Description 423 If a router receives a packet with a Hop Limit of zero, or a router 424 decrements a packet's Hop Limit to zero, it MUST discard the packet 425 and send an ICMPv6 Time Exceeded message with Code 0 to the source of 426 the packet. This indicates either a routing loop or too small an 427 initial Hop Limit value. 429 The rules for selecting the Source Address of this message are 430 defined in section 2.2. 432 Upper layer notification 434 An incoming Time Exceeded message MUST be passed to the upper-layer 435 protocol. 437 3.4 Parameter Problem Message 439 0 1 2 3 440 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 441 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 442 | Type | Code | Checksum | 443 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 444 | Pointer | 445 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 446 | As much of invoking packet | 447 + as will fit without the ICMPv6 packet + 448 | exceeding the minimum IPv6 MTU [IPv6] | 450 IPv6 Fields: 452 Destination Address 454 Copied from the Source Address field of the invoking 455 packet. 457 ICMPv6 Fields: 459 Type 4 461 Code 0 - erroneous header field encountered 463 1 - unrecognized Next Header type encountered 465 2 - unrecognized IPv6 option encountered 467 Pointer Identifies the octet offset within the 468 invoking packet where the error was detected. 470 The pointer will point beyond the end of the ICMPv6 471 packet if the field in error is beyond what can fit 472 in the maximum size of an ICMPv6 error message. 474 Description 476 If an IPv6 node processing a packet finds a problem with a field in 477 the IPv6 header or extension headers such that it cannot complete 478 processing the packet, it MUST discard the packet and SHOULD send an 479 ICMPv6 Parameter Problem message to the packet's source, indicating 480 the type and location of the problem. 482 The pointer identifies the octet of the original packet's header 483 where the error was detected. For example, an ICMPv6 message with 484 Type field = 4, Code field = 1, and Pointer field = 40 would indicate 485 that the IPv6 extension header following the IPv6 header of the 486 original packet holds an unrecognized Next Header field value. 488 Upper layer notification 490 A node receiving this ICMPv6 message MUST notify the upper-layer 491 protocol. 493 4. ICMPv6 Informational Messages 495 4.1 Echo Request Message 497 0 1 2 3 498 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 499 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 500 | Type | Code | Checksum | 501 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 502 | Identifier | Sequence Number | 503 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 504 | Data ... 505 +-+-+-+-+- 507 IPv6 Fields: 509 Destination Address 511 Any legal IPv6 address. 513 ICMPv6 Fields: 515 Type 128 517 Code 0 519 Identifier An identifier to aid in matching Echo Replies 520 to this Echo Request. May be zero. 522 Sequence Number 524 A sequence number to aid in matching Echo Replies 525 to this Echo Request. May be zero. 527 Data Zero or more octets of arbitrary data. 529 Description 531 Every node MUST implement an ICMPv6 Echo responder function that 532 receives Echo Requests and sends corresponding Echo Replies. A node 533 SHOULD also implement an application-layer interface for sending Echo 534 Requests and receiving Echo Replies, for diagnostic purposes. 536 Upper layer notification 538 A node receiving this ICMPv6 message MAY notify the upper-layer 539 protocol. 541 4.2 Echo Reply Message 543 0 1 2 3 544 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 545 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 546 | Type | Code | Checksum | 547 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 548 | Identifier | Sequence Number | 549 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 550 | Data ... 551 +-+-+-+-+- 553 IPv6 Fields: 555 Destination Address 557 Copied from the Source Address field of the invoking 558 Echo Request packet. 560 ICMPv6 Fields: 562 Type 129 564 Code 0 566 Identifier The identifier from the invoking Echo Request message. 568 Sequence The sequence number from the invoking Echo Request 569 Number message. 571 Data The data from the invoking Echo Request message. 573 Description 575 Every node MUST implement an ICMPv6 Echo responder function that 576 receives Echo Requests and sends corresponding Echo Replies. A node 577 SHOULD also implement an application-layer interface for sending Echo 578 Requests and receiving Echo Replies, for diagnostic purposes. 580 The source address of an Echo Reply sent in response to a unicast 581 Echo Request message MUST be the same as the destination address of 582 that Echo Request message. 584 An Echo Reply SHOULD be sent in response to an Echo Request message 585 sent to an IPv6 multicast address. The source address of the reply 586 MUST be a unicast address belonging to the interface on which the 587 multicast Echo Request message was received. 589 The data received in the ICMPv6 Echo Request message MUST be returned 590 entirely and unmodified in the ICMPv6 Echo Reply message. 592 Upper layer notification 594 Echo Reply messages MUST be passed to the ICMPv6 user interface, 595 unless the corresponding Echo Request originated in the IP layer. 597 5. Security Considerations 599 5.1 Authentication and Encryption of ICMP messages 601 ICMP protocol packet exchanges can be authenticated using the IP 602 Authentication Header [IPv6-AUTH]. A node SHOULD include an 603 Authentication Header when sending ICMP messages if a security 604 association for use with the IP Authentication Header exists for the 605 destination address. The security associations may have been created 606 through manual configuration or through the operation of some key 607 management protocol. 609 Received Authentication Headers in ICMP packets MUST be verified for 610 correctness and packets with incorrect authentication MUST be ignored 611 and discarded. 613 It SHOULD be possible for the system administrator to configure a 614 node to ignore any ICMP messages that are not authenticated using 615 either the Authentication Header or Encapsulating Security Payload. 616 Such a switch SHOULD default to allowing unauthenticated messages. 618 Confidentiality issues are addressed by the IP Security Architecture 619 and the IP Encapsulating Security Payload documents [IPv6-SA, 620 IPv6-ESP]. 622 5.2 ICMP Attacks 624 ICMP messages may be subject to various attacks. The following is a 625 discussion of such attacks and their prevention: 627 1. ICMP messages may be subject to actions intended to cause the 628 receiver believe the message came from a different source than the 629 message originator. The protection against this attack can be 630 achieved by applying the IPv6 Authentication mechanism [IPv6-Auth] 631 to the ICMP message. 633 2. ICMP messages may be subject to actions intended to cause the 634 message or the reply to it go to a destination different than the 635 message originator's intention. The ICMP checksum calculation 636 provides a protection mechanism against changes by a malicious 637 interceptor in the destination and source address of the IP packet 638 carrying that message, provided the ICMP checksum field is 639 protected against change by the encryption [IPv6-ESP] of the ICMP 640 message. 642 3. ICMP messages may be subject to changes in the message fields, or 643 payload. The encryption [IPv6-ESP] of the ICMP message is a 644 protection against such actions. 646 4. ICMP messages may be used as attempts to perform denial of service 647 attacks by sending back to back erroneous IP packets. An 648 implementation that correctly followed section 2.4, paragraph (f) 649 of this specifications, would be protected by the ICMP error rate 650 limiting mechanism. 652 5. ICMP messages may be used as attempts to perform denial of service 653 attacks by sending back to back ICMP "echo" messages that cause 654 the generation of back to back ICMP "echo reply" messages. An 655 implementation that correctly followed section 2.4, paragraph (f) 656 of this specifications, would be protected by the ICMP rate 657 limiting mechanism. 659 6. References 661 [IPv6] Deering, S., R. Hinden, "Internet Protocol, Version 6, 662 Specification", Internet Draft, November 21, 1997. 664 [IPv6-ADDR] Hinden, R., S. Deering, "IP Version 6 Addressing 665 Architecture", RFC2373, July 1998. 667 [IPv6-DISC] Narten, T., E. Nordmark, W. Simpson, "Neighbor Discovery 668 for IP Version 6 (IPv6)", Internet Draft, August 3, 669 1998. 671 [RFC-792] Postel, J., "Internet Control Message Protocol", RFC792. 673 [RFC-1122] Braden, R., "Requirements for Internet Hosts - 674 Communication Layers", RFC1122. 676 [PMTU] McCann, J., S. Deering, J. Mogul, "Path MTU Discovery 677 for IP version 6", RFC1981, August 1996. 679 [RFC-2119] Bradner, S., "Key words for use in RFCs to Indicate 680 Requirement Levels", RFC2119, BCP14, March 1997. 682 [IPv6-SA] Atkinson, R., S. Kent, "Security Architecture for the 683 Internet Protocol", Internet Draft, July 1998. 685 [IPv6-Auth] Atkinson, R., S. Kent, "IP Authentication Header", 686 Internet Draft, July 1998. 688 [IPv6-ESP] Atkinson, R., S. Kent, "IP Encapsulating Security 689 Protocol (ESP)", Internet Draft, July 1998. 691 7. Acknowledgments 693 The document is derived from previous ICMP drafts of the SIPP and 694 IPng working group. 696 The IPng working group and particularly Robert Elz, Jim Bound, Bill 697 Simpson, Thomas Narten, Charlie Lynn, Bill Fink, Scott Bradner, 698 Dimitri Haskin, and Bob Hinden (in chronological order) provided 699 extensive review information and feedback. 701 8. Authors' Addresses 703 Alex Conta Stephen Deering 704 Lucent Technologies Inc. Cisco Systems, Inc. 705 300 Baker Ave, Suite 100 170 West Tasman Drive 706 Concord, MA 01742 San Jose, CA 95134-1706 707 USA USA 709 phone: +1 508 287-2842 phone: +1 408 527-8213 710 email: aconta@lucent.com email: deering@parc.xerox.com 712 Appendix A - Changes from RFC 1885 714 Version 2-01 716 - Replaced all references to "576 octets" as the maximum for an ICMP 717 message size with "minimum IPv6 MTU" as defined by the base IPv6 718 specification. 719 - Removed rate control from informational messages 720 - Added requirement that receivers ignore code value in packet too 721 big message. 722 - Removed "Not a Neighbor" (code 2) from destination unreachable 723 message. 724 - Fix typos and update references. 726 Version 2-00 728 - Applied rate control to informational messages 729 - Removed section 2.4 on Group Management ICMP messages 730 - Removed references to IGMP in Abstract and Section 1. 731 - Updated references to other IPv6 documents 732 - Removed references to RFC-1112 in Abstract, and Section 1, and to 733 RFC-1191 in section 1, and section 3.2 734 - Added security section 735 - Added Appendix A - changes