idnits 2.17.1 draft-mastorakis-icnrg-icnping-02.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- ** The document seems to lack an IANA Considerations section. (See Section 2.2 of https://www.ietf.org/id-info/checklist for how to handle the case when there are no actions for IANA.) Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year == The document doesn't use any RFC 2119 keywords, yet seems to have RFC 2119 boilerplate text. -- The document date (August 25, 2017) is 2429 days in the past. Is this intentional? Checking references for intended status: Experimental ---------------------------------------------------------------------------- No issues found here. Summary: 1 error (**), 0 flaws (~~), 2 warnings (==), 1 comment (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 ICNRG S. Mastorakis 3 Internet-Draft UCLA 4 Intended status: Experimental J. Gibson 5 Expires: February 26, 2018 I. Moiseenko 6 Cisco Systems 7 R. Droms 9 D. Oran 10 August 25, 2017 12 ICN Ping Protocol Specification 13 draft-mastorakis-icnrg-icnping-02 15 Abstract 17 This document presents the design of an ICN Ping protocol. It 18 includes the operations both on the client and the forwarder side. 19 The design expresses the views of the authors and does not represent 20 the views of the Named Data Networking Project Team. 22 Status of This Memo 24 This Internet-Draft is submitted in full conformance with the 25 provisions of BCP 78 and BCP 79. 27 Internet-Drafts are working documents of the Internet Engineering 28 Task Force (IETF). Note that other groups may also distribute 29 working documents as Internet-Drafts. The list of current Internet- 30 Drafts is at http://datatracker.ietf.org/drafts/current/. 32 Internet-Drafts are draft documents valid for a maximum of six months 33 and may be updated, replaced, or obsoleted by other documents at any 34 time. It is inappropriate to use Internet-Drafts as reference 35 material or to cite them other than as "work in progress." 37 This Internet-Draft will expire on February 26, 2018. 39 Copyright Notice 41 Copyright (c) 2017 IETF Trust and the persons identified as the 42 document authors. All rights reserved. 44 This document is subject to BCP 78 and the IETF Trust's Legal 45 Provisions Relating to IETF Documents 46 (http://trustee.ietf.org/license-info) in effect on the date of 47 publication of this document. Please review these documents 48 carefully, as they describe your rights and restrictions with respect 49 to this document. Code Components extracted from this document must 50 include Simplified BSD License text as described in Section 4.e of 51 the Trust Legal Provisions and are provided without warranty as 52 described in the Simplified BSD License. 54 Table of Contents 56 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 57 1.1. Requirements Language . . . . . . . . . . . . . . . . . . 2 58 2. Background on IP-Based Ping Operation . . . . . . . . . . . . 3 59 3. Ping Functionality Challenges and Opportunities in ICN . . . 3 60 4. ICN Ping Echo CCNx Packet Formats . . . . . . . . . . . . . . 5 61 4.1. ICN Ping Echo Request CCNx Packet Format . . . . . . . . 5 62 4.2. Ping Echo Reply CCNx Packet Format . . . . . . . . . . . 8 63 5. ICN Ping Echo NDN Packet Formats . . . . . . . . . . . . . . 11 64 5.1. ICN Ping Echo Request NDN Packet Format . . . . . . . . . 11 65 5.2. Ping Echo Reply NDN Packet Format . . . . . . . . . . . . 12 66 6. Forwarder Handling . . . . . . . . . . . . . . . . . . . . . 13 67 7. Protocol Operation For Locally-Scoped Namespaces . . . . . . 14 68 8. Security Considerations . . . . . . . . . . . . . . . . . . . 15 69 9. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 15 70 10. References . . . . . . . . . . . . . . . . . . . . . . . . . 15 71 10.1. Normative References . . . . . . . . . . . . . . . . . . 15 72 10.2. Informative References . . . . . . . . . . . . . . . . . 15 73 Appendix A. Ping Client Application (Consumer) Operation . . . . 16 74 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 17 76 1. Introduction 78 Determining data plane reachability to a destination and taking 79 coarse performance measurements of round trip time are fundamental 80 facilities for network administration and troubleshooting. In IP, 81 where routing and forwarding are based on IP addresses, ICMP echo and 82 ICMP echo response are the protocol mechanisms used for this purpose, 83 generally exercised through the familiar ping utility. In ICN, where 84 routing and forwarding are based on name prefixes, the ability to 85 determine reachability of names is required. 87 This document proposes protocol mechanisms for a ping equivalent in 88 ICN networks. A non-normative appendix suggests useful properties 89 for an ICN ping client application, analogous to IP ping, that 90 originates echo requests and process echo replies. 92 1.1. Requirements Language 94 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 95 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 96 document are to be interpreted as described in [RFC2119]. 98 2. Background on IP-Based Ping Operation 100 In IP-based ping, an IP address is specified, either directly, or via 101 translation of a domain name through DNS. The ping client 102 application sends a number of ICMP Echo Request packets with the 103 specified IP address as the IP destination address and an IP address 104 from the client's host as the IP source address. 106 An ICMP Echo Request is forwarded across the network based on its 107 destination IP address. If it eventually reaches the destination, 108 the destination responds by sending back an ICMP Echo Reply packet to 109 the IP source address from the ICMP Echo Request. 111 If an ICMP Echo Request does not reach the destination or the Echo 112 reply is lost, the ping client times out. Any ICMP error messages, 113 such as "no route to destination", generated by the ICMP Echo Request 114 message are returned to the client and reported. 116 3. Ping Functionality Challenges and Opportunities in ICN 118 In ICN protocols (e.g., NDN and CCNx), the communication paradigm is 119 based exclusively on named objects. An Interest is forwarded across 120 the network based on its name. Eventually, it retrieves a content 121 object either from a producer application or some forwarder's Content 122 Store (CS). 124 IP-based ping was built as an add-on on top of an already existing 125 network architecture. In ICN, we have the opportunity to incorporate 126 diagnostic mechanisms directly in the network layer protocol, and 127 hopefully provide more powerful diagnostic capability than can be 128 realized through the layered ICMP Echo approach. 130 An ICN network differs from an IP network in at least 4 important 131 ways: 133 o IP identifies interfaces to an IP network with a fixed-length 134 number, and delivers IP packets to one or more interfaces. ICN 135 identifies units of data in the network with a variable length 136 name consisting of a list of components. 138 o An IP-based network depends on the IP packets having source IP 139 addresses that are used as the destination address for replies. 140 On the other hand, ICN Interests do not have source addresses and 141 they are forwarded based on names, which do not refer to a unique 142 end-point. Data packets follow the reverse path of the Interests 143 based on hop-by-hop state created during Interest forwarding. 145 o An IP network supports multi-path, single destination, stateless 146 packet forwarding and delivery via unicast, a limited form of 147 multi-destination selected delivery with anycast, and group-based 148 multi-destination delivery via multicast. In contrast, ICN 149 supports multi-path and multi-destination stateful Interest 150 forwarding and multi-destination data delivery to units of named 151 data. This single forwarding semantic subsumes the functions of 152 unicast, anycast, and multicast. As a result, consecutive (or 153 retransmitted) ICN Interest messages may be forwarded through an 154 ICN network along different paths, and may be forwarded to 155 different data sources (e.g., end-node applications, in-network 156 storage) holding a copy of the requested unit of data. This can 157 lead to a significant variance in round-trip times, which might 158 not be desirable in the case of a network troubleshooting 159 mechanism like ping. 161 o In the case of multiple Interests with the same name arriving at a 162 forwarder, a number of Interests may be aggregated in a common 163 Pending Interest Table (PIT) entry. Depending on the lifetime of 164 a PIT entry, the round-trip time an Interest-Data exchange might 165 significantly vary (e.g., it might be shorter than the full round- 166 trip time to reach the original content producer). To this end, 167 the round-trip time experienced by consumers might also vary. 169 These differences introduce new challenges, new opportunities and new 170 requirements in the design of an ICN ping protocol. Following this 171 communication model, a ping client should be able to express ping 172 echo requests with some name prefix and receive responses. 174 Our goals are the following: 176 o Test the reachability and the operation of an ICN forwarder. 178 o Test the reachability of an application (in the sense of whether 179 Interests for a prefix that it serves can be forwarded to it) and 180 discover the forwarder with local connectivity to (an instance of) 181 the application. 183 o Test whether a specific named object is cached in some on-path CS, 184 and, if so, return the corresponding forwarder. 186 o Perform some simple network performance measurements. 188 To this end, a ping name can represent: 190 o An administrative name that has been assigned to a forwarder. 192 o A name that includes an application's namespace as a prefix. 194 o A named object that might reside in some in-network storage. 196 In order to provide stable and reliable diagnostics, it is desirable 197 that the packet encoding of a ping echo request enables the 198 forwarders to distinguish a ping from a normal Interest, while also 199 allowing for forwarding behavior to be as similar as possible to that 200 of an Interest packet. In the same way, the encoding of a ping echo 201 reply should allow for forwarder processing similar to that used for 202 data packets. 204 The ping protocol should also enable relatively stable round-trip 205 time measurements. To this end, it is important to have a mechanism 206 to steer consecutive ping echo requests for the same name towards a 207 common path. 209 It is also important, in the case of ping echo requests for the same 210 name from different sources, to have a mechanism to avoid aggregating 211 those requests in the PIT. To this end, we need some encoding in the 212 ping echo requests to make each request for a common name unique, and 213 hence avoid PIT aggregation and further enabling the exact matching 214 of a response with a particular ping packet. 216 4. ICN Ping Echo CCNx Packet Formats 218 In this section, we describe the Echo Packet Format according to the 219 CCNx packet format [CCNMessages], where messages exist within 220 outermost containments (packets). Specifically, we propose two types 221 of ping packets, an echo request and an echo reply packet type. 223 4.1. ICN Ping Echo Request CCNx Packet Format 225 The format of the ping echo request packet is presented below: 227 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 229 +---------------+---------------+---------------+---------------+ 230 | | | | 231 | Version | EchoRequest | PacketLength | 232 | | | | 233 +---------------+---------------+---------------+---------------+ 234 | | | | | 235 | HopLimit | Reserved | Flags | HeaderLength | 236 | | | | | 237 +---------------+---------------+---------------+---------------+ 238 / / 239 / PathSteering TLV / 240 / / 241 +---------------+---------------+---------------+---------------+ 242 | | 243 | Echo Request Message TLVs | 244 | | 245 +---------------+---------------+---------------+---------------+ 247 Echo Request CCNx Packet Format 249 The existing packet header fields have similar functionality to the 250 header fields of a CCNx Interest packet. The value of the packet 251 type field is Echo Request. The exact numeric value of this field 252 type is to be determined. 254 Compared to the typical format of a CCNx packet header [CCNMessages], 255 there is a new optional fixed header TLV added to the packet header: 257 o A PathSteering hop-by-hop header TLV, which is constructed hop-by- 258 hop in the echo reply and included in the echo request to steer 259 consecutive echo requests expressed by a ping client towards a 260 common forwarding path. An example of such a scheme is presented 261 in [LIPSIN]. 263 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 265 +---------------+---------------+---------------+---------------+ 266 | | | 267 | PathSteering_Type | PathSteering_Length | 268 | | | 269 +---------------+---------------+---------------+---------------+ 270 | | 271 | PathSteering_Value | 272 | | 273 +---------------+---------------+---------------+---------------+ 275 PathSteering TLV 277 The message of an echo request is presented below: 279 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 281 +---------------+---------------+---------------+---------------+ 282 | | | 283 | MessageType = 1 | MessageLength | 284 | | | 285 +---------------+---------------+---------------+---------------+ 286 | | 287 | Name TLV | 288 | | 289 +---------------+---------------+---------------+---------------+ 291 Echo Request Message Format 293 The echo request message is of type Interest in order to leverage the 294 Interest forwarding behavior provided by the network. The Name TLV 295 has the structure described in [CCNMessages]. The name consists of 296 the prefix that we would like to ping appended with a nonce typed 297 name component as its last component. The value of this TLV will be 298 a 64-bit nonce. The purpose of the nonce is to avoid Interest 299 aggregation and allow client matching of replies with requests. As 300 described below, the nonce is ignored for CS checking. 302 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 304 +---------------+---------------+---------------+---------------+ 305 | | | 306 | Nonce_Type | Nonce_Length = 8 | 307 | | | 308 +---------------+---------------+---------------+---------------+ 309 | | 310 | | 311 | | 312 | Nonce_Value | 313 | | 314 | | 315 +---------------+---------------+---------------+---------------+ 317 Nonce Typed Name Component TLV 319 4.2. Ping Echo Reply CCNx Packet Format 321 The format of a ping echo reply packet is presented below: 323 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 325 +---------------+---------------+---------------+---------------+ 326 | | | | 327 | Version | EchoReply | PacketLength | 328 | | | | 329 +---------------+---------------+---------------+---------------+ 330 | | | | 331 | Reserved | Flags | HeaderLength | 332 | | | | 333 +---------------+---------------+---------------+---------------+ 334 | | 335 | PathSteering TLV | 336 | | 337 +---------------+---------------+---------------+---------------+ 338 | | 339 | Echo Reply Message TLVs | 340 | | 341 +---------------+---------------+---------------+---------------+ 343 Echo Reply CCNx Packet Format 345 The header of an echo reply consists of the header fields of a CCNx 346 Content Object and a hop-by-hop PathSteering TLV. The value of the 347 packet type field is Echo Reply. The exact numeric value of this 348 field type is to be determined. The PathSteering header TLV is as 349 defined for the echo request packet. 351 A ping echo reply message is of type Content Object, contains a Name 352 TLV (name of the corresponding echo request), a PayloadType TLV and 353 an ExpiryTime TLV with a value of 0 to indicate that echo replies 354 must not be cached by the network. 356 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 358 +---------------+---------------+---------------+---------------+ 359 | | | 360 | MessageType = 2 | MessageLength | 361 | | | 362 +---------------+---------------+---------------+---------------+ 363 | | 364 | Name TLV | 365 | | 366 +---------------+---------------+---------------+---------------+ 367 | | 368 | PayloadType TLV | 369 | | 370 +---------------+---------------+---------------+---------------+ 371 | | 372 | ExpiryTime TLV | 373 | | 374 +---------------+---------------+---------------+---------------+ 376 Echo Reply Message Format 378 The PayloadType TLV is presented below. It is of type 379 T_PAYLOADTYPE_DATA, and the data schema consists of 3 TLVs: 1) the 380 name of the sender of this reply (with the same structure as a CCNx 381 Name TLV), 2) the sender's signature of their own name (with the same 382 structure as a CCNx ValidationPayload TLV), 3) a TLV with return 383 codes to indicate what led to the generation of this reply (i.e., 384 existence of a local application, a CS hit or a match with a 385 forwarder's administrative name as specified in Section 6). 387 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 389 +---------------+---------------+---------------+---------------+ 390 | | | 391 | T_PAYLOADTYPE_DATA | Length | 392 | | | 393 +---------------+---------------+---------------+---------------+ 394 / / 395 / Sender's Name TLV / 396 / / 397 +---------------+---------------+---------------+---------------+ 398 / / 399 / Sender's Signature TLV / 400 / / 401 +---------------+---------------+---------------+---------------+ 402 / / 403 / Echo Reply Code TLV / 404 / / 405 +---------------+---------------+---------------+---------------+ 407 Echo Reply Message Format 409 The goal of including the name of the sender in the echo reply is to 410 enable the user to reach this entity directly to ask for further 411 management/administrative information using generic Interest-Data 412 exchanges after a successful verification of the sender's name. 414 The structure of the Echo Reply Code TLV is presented below (16-bit 415 value). The potential values are the following: 417 o 1: Indicates that the target name matched the administrative name 418 of a forwarder. 420 o 2: Indicates that the target name matched a prefix served by an 421 application. 423 o 3: Indicates that the target name matched the name of an object in 424 a forwarder's CS. 426 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 428 +---------------+---------------+---------------+---------------+ 429 | | | 430 | Echo_Reply_Code_Type | Echo_Reply_Code_Length = 2 | 431 | | | 432 +---------------+---------------+---------------+---------------+ 433 | | 434 | Echo_Reply_Code_Value | 435 +---------------+---------------+---------------+---------------+ 437 Echo Reply Code TLV 439 5. ICN Ping Echo NDN Packet Formats 441 In this section, we present the ICN Ping Echo Request and Reply 442 Format according to the NDN packet specification [NDNTLV]. 444 5.1. ICN Ping Echo Request NDN Packet Format 446 An echo request is encoded as an NDN Interest packet. Its format is 447 the following: 449 EchoRequest ::= INTEREST-TYPE TLV-LENGTH 450 Name 451 MustBeFresh 452 Nonce 453 PathSteering TLV? 455 Echo Request NDN Packet Format 457 The name of an echo request consists of the prefix to be pinged, a 458 nonce value (it can be the value of the Nonce field) and the suffix 459 "ping" to denote that this Interest is a ping request. 461 An echo request contains a new optional field for the hop-by-hop 462 PathSteering TLV. The format of this field is the following: 464 PathSteering TLV ::= PATHSTEERING-TLV-TYPE TLV-LENGTH BYTE{8} 466 PathSteering TLV 468 Since the NDN packet format does not provide a mechanism to prevent 469 the network from caching specific data packets, we will use the 470 MustBeFresh selector for echo requests (in combination with a 471 Freshness Period TLV of value 0 for echo replies) to avoid fetching 472 cached echo replies. 474 5.2. Ping Echo Reply NDN Packet Format 476 An echo reply is encoded as an NDN Data packet. Its format is the 477 following: 479 EchoReply ::= DATA-TLV TLV-LENGTH 480 PathSteering TLV 481 Name 482 MetaInfo 483 Content 484 Signature 486 Echo Reply NDN Packet Format 488 Compared to the format of a regular NDN Data packet, an echo reply 489 contains a PathSteering TLV field, which is not included in the 490 security envelope, since it might be modified in a hop-by-hop fashion 491 by the forwarders along the reverse path. 493 The name of an echo reply is the name of the corresponding echo 494 request, while the format of the MetaInfo field is the following: 496 MetaInfo ::= META-INFO-TYPE TLV-LENGTH 497 ContentType 498 FreshnessPeriod 500 MetaInfo TLV 502 The value of the ContentType TLV is 0. The same applies to the value 503 of the FreshnessPeriod TLV, so that the replies are treated as stale 504 data as soon as they are received by a forwarder. 506 The content of an echo reply consists of the following 2 TLVs: 507 Sender's name (with a structure similar as an NDN Name TLV) and Echo 508 Reply Code. There is no need to have a separate TLV for the sender's 509 signature in the content of the reply, since every NDN data packet 510 carries the signature of the data producer. 512 The Echo Reply Code TLV format is the following (with the values 513 specified in Section 4.2): 515 EchoReplyCode ::= ECHOREPLYCODE-TLV-TYPE TLV-LENGTH BYTE{2} 517 Echo Reply Code TLV 519 6. Forwarder Handling 521 When a forwarder receives an echo request, it will first extract the 522 message's base name (i.e., the request name with the Nonce name 523 component excluded and the suffix "ping" in the case of an echo 524 request with the NDN packet format). 526 In some cases, the forwarder will originate an echo reply, sending 527 the reply downstream through the face on which the echo request was 528 received. An echo reply will include the forwarder's own name and 529 signature, and, the appropriate echo reply code based on the 530 condition that triggered the reply generation. It will also include 531 a pathSteering TLV, initially a null value (since the echo reply 532 originator does not forward the request and, thus, does not make a 533 path choice). 535 The forwarder generates an echo reply in the following cases: 537 o Assuming that a forwarder has been given one or more 538 administrative names, the echo request base name exactly matches 539 any of the forwarder's administrative name(s). 541 o The echo request's base name exactly matches the name of a 542 content-object residing in the forwarder's CS (unless the ping 543 client application has chosen not to receive replies due to CS 544 hits as specified in Appendix A). 546 o The echo request base name matches (in a Longest Prefix Match 547 manner) a FIB entry with an outgoing face referring to a local 548 application. 550 If none of the conditions to reply to the echo request are met, the 551 forwarder will attempt to forward the echo request upstream based on 552 the path steering value (if present) the results of the FIB LPM 553 lookup and PIT creation (based on the name including the nonce typed 554 name component and the suffix "ping" in the case of an echo request 555 with the NDN packet format). If no valid next-hop is found, an 556 InterestReturn is sent downstream (as with a failed attempt to 557 forward an ordinary Interest). 559 A received echo reply will be matched to an existing PIT entry as 560 usual. On the reverse path, the path steering TLV of an echo reply 561 will be updated by each forwarder to encode its next-hop choice. 562 When included in subsequent echo requests, this pathSteering TLV will 563 allow the forwarders to steer the requests along the same path. 565 7. Protocol Operation For Locally-Scoped Namespaces 567 In this section, we elaborate on 2 alternative design approaches in 568 cases that the pinged prefix corresponds to a locally-scoped 569 namespace not directly routable from the client's local network. 571 The first approach leverages the NDN Link Object [SNAMP]. 572 Specifically, the ping client attaches to the expressed request a 573 LINK Object that contains a number of routable name prefixes, based 574 on which the request can be forwarded across the Internet utill it 575 reaches a network region, where the request name itself is routable. 576 A LINK Object is created and signed by a data producer allowed to 577 publish data under a locally-scoped namespace. The way that a client 578 retrieves a LINK Object has to do with the overall network 579 architecture design and is out of the scope of the current draft. 581 Based on the current deployment of the LINK Object by the NDN team, a 582 forwarder at the boarder of the region, where an Interest name 583 becomes routable has to remove the LINK Object from the incoming 584 Interests. The Interest state maintained along the entire forwarding 585 path is based on the Interest name regardless of whether it was 586 forwarded based on its name or a routable prefix in the LINK Object. 588 The second approach is based on prepending a routable prefix to the 589 locally-scoped name. The resulting prefix will be the name of the 590 echo requests expressed by the client. In this way, a request will 591 be forwarded across the Internet based on the routable part of its 592 name. When it reaches the network region, where the original 593 locally-scoped name is routable, the boarder forwarder will have to 594 rewrite the request name and delete its routable part. There are two 595 conditions for a forwarder to perform this rewriting operation on a 596 request: 1) the routable part of the request name matches a routable 597 name of the network region adjacent to the forwarder (assuming that a 598 forwarder is aware of those names) and 2) the remaining part of the 599 request name is routable across the network region of this forwarder. 601 The state maintained along the path, where the locally-scoped name is 602 not routable, is based on the routable prefix along with the locally- 603 scoped prefix. Within the network region that the locally-scoped 604 prefix is routable, the state is based only on it. To ensure that 605 the generated replies will reach the ping client, the boarder 606 forwarder has also to rewrite the name of a reply and prepend the 607 routable prefix of the corresponding echo request. 609 8. Security Considerations 611 To avoid reflection attacks in the case of an echo reply with the 612 CCNx packet format, where a compromised forwarder includes in the 613 reply the name of a victim forwarder to redirect the future 614 administrative traffic towards the victim, the forwarder that 615 generates a reply has to sign the name included in the payload. In 616 this way, the client is able to verify that the included name is 617 legitimate and refers to the forwarder that generated the reply. 618 Alternatively, the forwarder can include in the reply payload their 619 routable prefix(es) encoded as a signed NDN Link Object [SNAMP]. 621 Interest flooding attack amplification is possible in the case of the 622 second approach to deal with locally-scoped namespaces described in 623 Section 7. A boarder forwarder will have to maintain extra state, so 624 that to prepend the right routable prefix to the name of an outgoing 625 reply, since the forwarder might be attached to multiple network 626 regions (reachable under different prefixes) or a network region 627 attached to this forwarder might be reachable under multiple routable 628 prefixes. 630 9. Acknowledgements 632 The authors would like to thank Mark Stapp for the fruitful 633 discussion on the objectives of ICN ping protocol. 635 10. References 637 10.1. Normative References 639 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 640 Requirement Levels", BCP 14, RFC 2119, 641 DOI 10.17487/RFC2119, March 1997, . 644 10.2. Informative References 646 [CCNMessages] 647 Mosko, M., Solis, I., and C. Wood, "CCNx Messages in TLV 648 Format.", 2016, . 651 [LIPSIN] Jokela, P. and et al, "LIPSIN: line speed publish/ 652 subscribe inter-networking, ACM SIGCOMM Computer 653 Communication Review 39.4: 195-206", 2009. 655 [NDNTLV] NDN Project Team, "NDN Packet Format Specification.", 656 2016, . 658 [SNAMP] Afanasyev, A. and et al, "SNAMP: Secure namespace mapping 659 to scale NDN forwarding, IEEE Conference on Computer 660 Communications Workshops (INFOCOM WKSHPS)", 2015. 662 Appendix A. Ping Client Application (Consumer) Operation 664 This section is an informative appendix regarding the proposed ping 665 client operation. 667 The ping client application is responsible for generating echo 668 requests for prefixes provided by users. 670 When generating a series of echo requests for a specific name, the 671 first echo request will typically not include a PathSteering TLV, 672 since no TLV value is known. After an echo reply containing a 673 PathSteering TLV is received, each subsequent echo request can 674 include the received path steering value in the PathSteering header 675 TLV to drive the requests towards a common path as part of checking 676 the network performance. To discover more paths, a client can omit 677 the path steering TLV in future requests. Moreover, for each new 678 ping echo request, the client has to generate a new nonce and record 679 the time that the request was expressed. It will also set the 680 lifetime of an echo request, which will have semantics similar to the 681 lifetime of an Interest. 683 Moreover, the client application might like not to receive echo 684 replies due to CS hits. A mechanism to achieve that in CCNx would be 685 to use a Content Object Hash Restriction TLV with a value of 0 in the 686 payload of an echo request message. In NDN, the exclude filter 687 selector can be used. 689 When it receives an echo reply, the client would typically match the 690 reply to a sent request and compute the round-trip time of the 691 request. It should parse the PathSteering value and decode the 692 reply's payload to parse the the sender's name and signature. The 693 client should verify that both the received message and the 694 forwarder's name have been signed by the key of the forwarder, whose 695 name is included in the payload of the reply (by fetching this 696 forwarder's public key and verifying the contained signature). The 697 client can also decode the Echo Reply Code TLV to understand the 698 condition that triggered the generation of the reply. 700 In the case that an echo reply is not received for a request within a 701 certain time interval (lifetime of the request), the client should 702 time-out and send a new request with a new nonce value up to some 703 maximum number of requests to be sent specified by the user. 705 Authors' Addresses 707 Spyridon Mastorakis 708 UCLA 709 Los Angeles, CA 710 US 712 Email: mastorakis@cs.ucla.edu 714 Jim Gibson 715 Cisco Systems 716 Cambridge, MA 717 US 719 Email: gibson@cisco.com 721 Ilya Moiseenko 722 Cisco Systems 723 San Jose, CA 724 US 726 Email: iliamo@mailbox.org 728 Ralph Droms 729 Cambridge, MA 730 US 732 Email: rdroms.ietf@gmail.com 734 Dave Oran 735 Cambridge, MA 736 US 738 Email: daveoran@orandom.net