RFC 9507 | ICN Traceroute | March 2024 |
Mastorakis, et al. | Experimental | [Page] |
This document presents the design of an Information-Centric Networking (ICN) Traceroute protocol. This includes the operation of both the client and the forwarder.¶
This document is a product of the Information-Centric Networking Research Group (ICNRG) of the IRTF.¶
This document is not an Internet Standards Track specification; it is published for examination, experimental implementation, and evaluation.¶
This document defines an Experimental Protocol for the Internet community. This document is a product of the Internet Research Task Force (IRTF). The IRTF publishes the results of Internet-related research and development activities. These results might not be suitable for deployment. This RFC represents the consensus of the Information-Centric Networking Research Group of the Internet Research Task Force (IRTF). Documents approved for publication by the IRSG are not candidates for any level of Internet Standard; see Section 2 of RFC 7841.¶
Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at https://www.rfc-editor.org/info/rfc9507.¶
Copyright (c) 2024 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document.¶
In TCP/IP, routing and forwarding are based on IP addresses. To ascertain the route to an IP address and to measure the transit delays, the traceroute utility is commonly used. In Information-Centric Networking (ICN), routing and forwarding are based on name prefixes. To this end, the ability to ascertain the characteristics of at least one of the available routes to a name prefix is a fundamental requirement for instrumentation and network management. These characteristics include, among others, route properties such as which forwarders were transited and the delay incurred through forwarding.¶
In order to carry out meaningful experimentation and deployment of ICN protocols, new tools analogous to ping and traceroute used for TCP/IP are needed to manage and debug the operation of ICN architectures and protocols. This document describes the design of a management and debugging protocol analogous to the traceroute protocol of TCP/IP; this new management and debugging protocol will aid the experimental deployment of ICN protocols. As the community continues its experimentation with ICN architectures and protocols, the design of ICN Traceroute might change accordingly. ICN Traceroute is designed as a tool to troubleshoot ICN architectures and protocols. As such, this document is classified as an Experimental RFC.¶
This specification uses the terminology defined in [RFC8793].¶
This RFC represents the consensus of the Information-Centric Networking Research Group (ICNRG) of the Internet Research Task Force (IRTF).¶
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶
In IP-based networks, traceroute is based on the expiration of the Time To Live (TTL) IP header field. Specifically, a traceroute client sends consecutive packets (depending on the implementation and the user-specified behavior, such packets can be either UDP datagrams, ICMP Echo Request packets, or TCP SYN packets) with a TTL value increased by 1, essentially performing an expanding ring search. In this way, the first IP packet sent will expire at the first router along the path, the second IP packet at the second router along the path, etc., until the router (or host) with the specified destination IP address is reached. Each router along the path towards the destination responds by sending back an ICMP Time Exceeded packet, unless explicitly prevented from doing so by a security policy.¶
The IP-based traceroute utility operates on IP addresses and in particular depends on the IP packets having source IP addresses that are used as the destination address for replies. Given that ICN forwards based on names rather than destination IP addresses, that the names do not refer to unique endpoints (multi-destination), and that the packets do not contain source addresses, a substantially different approach is needed.¶
In the Named Data Networking (NDN) and Content-Centric Networking (CCNx) protocols, the communication paradigm is based exclusively on named objects. An Interest message is forwarded across the network based on its name. Eventually, it retrieves a Content Object from either a producer application or some forwarder's Content Store (CS).¶
An ICN network differs from an IP network in at least four important ways (four of which are as follows):¶
These differences introduce new challenges, new opportunities, and new requirements regarding the design of ICN Traceroute. Following this communication model, a traceroute client should be able to express traceroute requests directed to a name prefix and receive responses.¶
Our goals are as follows:¶
To this end, a traceroute target name can represent:¶
In order to provide stable and reliable diagnostics, it is desirable that the packet encoding of a traceroute request enable the forwarders to distinguish this request from a normal Interest while also diverging as little as possible from the forwarding behavior for an Interest packet. In the same way, the encoding of a traceroute reply should minimize any processing differences from those employed for a data packet by the forwarders.¶
The term "traceroute session" is used for an iterative process during which an endpoint client application generates a number of traceroute requests to successively traverse more distant hops in the path until it receives a final traceroute reply from a forwarder. It is desirable that ICN Traceroute be able to discover a number of paths towards the expressed prefix within the same session or subsequent sessions. To discover all the hops in a path, we need a mechanism (Interest Steering) to steer requests along different paths. Such a capability was initially published in [PATHSTEERING] and has been specified for CCNx and NDN in [RFC9531].¶
In the case of traceroute requests for the same prefix from different sources, it is also important to have a mechanism to avoid aggregating those requests in the PIT. To this end, we need some encoding in the traceroute requests to make each request for a common prefix unique, hence avoiding PIT aggregation and further enabling the exact matching of a response with a particular traceroute packet.¶
The packet types and formats are presented in Section 4. Procedures for determining and indicating that a destination has been reached are included in Section 6.¶
In this section, we present the CCNx packet formats [RFC8609] of ICN Traceroute where messages exist within outermost containments (packets). Specifically, we propose two types of traceroute packets: a traceroute request and a traceroute reply.¶
The format of the traceroute request packet is presented below:¶
The existing packet header fields have functionality similar to that of the header fields of a CCNx Interest packet. The value of the packet type field is PT_TR_REQUEST. See Section 9 for the value assignment.¶
In contrast to the typical format of a CCNx packet header [RFC8609], there is a new optional fixed header added to the packet header:¶
The message of a traceroute request is presented below:¶
The traceroute request message is of type T_DISCOVERY. The Name TLV has the structure described in [RFC8609]. The name consists of the target (destination) prefix appended with a nonce typed name as its last segment. The nonce can be encoded as a base64-encoded string with the URL-safe alphabet as defined in Section 5 of [RFC4648], with padding omitted. The format of this TLV is a 64-bit nonce. See [RFC9508] for the value assignment. The purpose of the nonce is to avoid Interest aggregation and allow client matching of replies with requests. As described below, the nonce is ignored for CS checking.¶
The format of a traceroute reply packet is presented below:¶
The header of a traceroute reply consists of the header fields of a CCNx Content Object and a hop-by-hop Path Steering TLV. The value of the packet type field is PT_TR_REPLY. See Section 9 for the value assignment.¶
A traceroute reply message is of type T_OBJECT and contains a Name TLV (name of the corresponding traceroute request), a PayloadType TLV, and an ExpiryTime TLV with a value of 0 to indicate that replies must not be returned from network caches.¶
The PayloadType TLV is presented below. It is of type T_PAYLOADTYPE_DATA, and the data schema consists of three TLVs:¶
The goal of including the name of the sender in the reply is to enable the user to reach this entity directly to ask for further management/administrative information using generic Interest-Data exchanges or by employing a more comprehensive management tool, such as CCNinfo [RFC9344], after a successful verification of the sender's name.¶
The structure of the PT_TR_REPLY Code TLV is presented below (16-bit value). The four assigned values are as follows:¶
In this section, we present the ICN Traceroute Request and Reply packet formats according to the NDN packet format specification [NDNTLV].¶
A traceroute request is encoded as an NDN Interest packet. Its format is as follows:¶
The name of a request consists of the target name, a nonce value (it can be the value of the Nonce field), and the suffix "traceroute" to denote that this Interest is a traceroute request (added as a KeywordNameComponent [NDNTLV]). When the "ApplicationParameters" element is present, a ParametersSha256DigestComponent (Section 6) is added as the last name segment.¶
A traceroute request MAY carry a Path Label TLV in the NDN Link Adaptation Protocol [NDNLPv2] as specified in [RFC9531].¶
Since the NDN packet format does not provide a mechanism to prevent the network from caching specific data packets, we instead use the MustBeFresh TLV for requests (in combination with a FreshnessPeriod TLV with a value of 1 for replies) to avoid fetching cached traceroute replies with a freshness period that has expired [REALTIME].¶
A traceroute reply is encoded as an NDN Data packet. Its format is as follows:¶
A traceroute reply MAY carry a Path Label TLV in the NDN Link Adaptation Protocol [NDNLPv2] as specified in [RFC9531], since it might be modified in a hop-by-hop fashion by the forwarders along the reverse path.¶
The name of a traceroute reply is the name of the corresponding traceroute request while the format of the MetaInfo field is as follows:¶
The value of the ContentType TLV is 0. The value of the FreshnessPeriod TLV is 1, so that the replies are treated as stale data (almost instantly) as they are received by a forwarder.¶
The content of a traceroute reply consists of the following two TLVs: Sender's Name (an NDN Name TLV) and Traceroute Reply Code. There is no need to have a separate TLV for the sender's signature in the content of the reply, since every NDN Data packet carries the signature of the data producer.¶
The Traceroute Reply Code TLV format is as follows (with the values specified in Section 4.2):¶
When a forwarder receives a traceroute request, the HopLimit value is checked and decremented, and the target name (i.e., the name of the traceroute request without the last Nonce name segment as well as the suffix "traceroute" and the ParametersSha256DigestComponent in the case of a request with the NDN packet format) is extracted.¶
If the HopLimit has not expired (i.e., is greater than 0), the forwarder will forward the request upstream based on CS lookup, PIT creation, Longest Name Prefix Match (LNPM) lookup, and (if present) the path steering value. If no valid next hop is found, an InterestReturn indicating "No Route" in the case of CCNx or a network NACK in the case of NDN is sent downstream.¶
If HopLimit equals 0, the forwarder generates a traceroute reply. This reply includes the forwarder's administrative name and signature, and a Path Label TLV. This TLV initially has a null value, since the traceroute reply originator does not forward the request and thus does not make a path choice. The reply will also include the corresponding PT_TR_REPLY Code TLV.¶
A traceroute reply will be the final reply of a traceroute session if any of the following conditions are met:¶
The PT_TR_REPLY Code TLV value of the reply is set to indicate the specific condition that was met. If none of those conditions were met, the PT_TR_REPLY Code is set to 4 to indicate that the HopLimit reached 0.¶
A received traceroute reply will be matched to an existing PIT entry as usual. On the reverse path, the Path Steering TLV of a reply will be updated by each forwarder to encode its choice of next hop(s). When included in subsequent requests, this Path Steering TLV allows the forwarders to steer the requests along the same path.¶
In this section, we elaborate on two alternative design approaches in cases where the traceroute target prefix corresponds to a locally scoped namespace not directly routable from the client's local network.¶
The first approach leverages the NDN Link Object [SNAMP]. Specifically, the traceroute client attaches to the expressed request a Link Object that contains a number of routable name prefixes, based on which the request can be forwarded across the Internet until it reaches a network region where the request name itself is routable. A Link Object is created and signed by a data producer allowed to publish data under a locally scoped namespace. The way that a client retrieves a Link Object depends on various network design factors and is out of scope for this document.¶
At the time of this writing, and based on the current deployment of the Link Object by the NDN team [NDNLPv2], a forwarder at the border of the region where an Interest name becomes routable has to remove the Link Object from the incoming Interests. The Interest state maintained along the entire forwarding path is based on the Interest name regardless of whether it was forwarded based on this name or a prefix in the Link Object.¶
The second approach is based on prepending a routable prefix to the locally scoped name. The resulting prefix will be the name of the traceroute requests expressed by the client. In this way, a request will be forwarded based on the routable part of its name. When it reaches the network region where the original locally scoped name is routable, the border forwarder rewrites the request name and deletes its routable part. A forwarder will perform this rewriting operation on a request if the following two conditions are met:¶
The state along the path depends on whether the request is traversing the portion of the network where the locally scoped name is routable. In this case, the forwarding can be based entirely on the locally scoped name. However, where a portion of the path lies outside the region where the locally scoped name is routable, the border router has to rewrite the name of a reply and prepend the routable prefix of the corresponding request to ensure that the generated replies will reach the client.¶
A reflection attack could occur in the case of a traceroute reply with the CCNx packet format if a compromised forwarder includes in the reply the name of a victim forwarder. This could redirect the future administrative traffic towards the victim. To foil such reflection attacks, the forwarder that generates a traceroute reply MUST sign the name included in the payload. In this way, the client is able to verify that the included name is legitimate and refers to the forwarder that generated the reply. Alternatively, the forwarder could include in the reply payload their routable prefix(es) encoded as a signed NDN Link Object [SNAMP].¶
This approach does not protect against on-path attacks where a compromised forwarder that receives a traceroute reply replaces the forwarder's name and the signature in the message with its own name and signature to make the client believe that the reply was generated by the compromised forwarder. To foil such attack scenarios, a forwarder can sign the reply message itself. In such cases, the forwarder does not have to sign its own name in the reply message, since the message signature protects the message as a whole and will be invalidated in the case of an on-path attack. Additionally, a forwarder could swap out the name of a traceroute request with a name of its choosing. In this case, however, the response with the spoofed name will not be received by a client, since the change of name would invalidate the state in the PIT on the path back to the client.¶
Signing each traceroute reply message can be expensive and can potentially lead to computation attacks against forwarders. To mitigate such attack scenarios, the processing of traceroute requests and the generation of the replies SHOULD be handled by a separate management application running locally on each forwarder. The serving of traceroute replies is thereby separated from load on the forwarder itself. The approaches used by ICN applications to manage load may also apply to the forwarder's management application.¶
Interest flooding attack amplification is possible in the case of the second approach for dealing with locally scoped namespaces as described in Section 7. A border forwarder will have to maintain extra state to prepend the correct routable prefix to the name of an outgoing reply, since the forwarder might be attached to multiple network regions (reachable under different prefixes) or a network region attached to this forwarder might be reachable under multiple routable prefixes.¶
We also note that traceroute requests have the same privacy characteristics as regular Interests.¶
IANA has assigned 0x07 to "PT_TR_REQUEST" and 0x08 to "PT_TR_REPLY" in the "CCNx Packet Types" registry established by [RFC8609].¶
This section is an informative appendix regarding the proposed traceroute client operation.¶
The client application is responsible for generating traceroute requests for prefixes provided by users.¶
The overall process can be iterative: the first traceroute request of each session will have a HopLimit of 1 to reach the first hop forwarder, the second request will have a HopLimit of 2 to reach the second hop forwarder, and so on.¶
When generating a series of requests for a specific name, the first request will typically not include a Path Label TLV, since no TLV value is known. After a traceroute reply containing a Path Label TLV is received, each subsequent request might include the received path steering value in the Path Label header TLV to drive the requests towards a common path as part of checking network performance. To discover more paths, a client can omit the Path Label TLV in future requests. Moreover, for each new traceroute request, the client has to generate a new nonce and record the time that the request was expressed. The client also sets the lifetime of the traceroute request, which carries the same semantics as the Interest Lifetime [RFC8609] in an Interest.¶
Moreover, the client application might not wish to receive replies due to CS hits. In CCNx, a mechanism to achieve that would be to use a Content Object Hash Restriction TLV with a value of 0 in the payload of a traceroute request message. In NDN, the exclude filter selector can be used.¶
When it receives a traceroute reply, the client would typically match the reply to a sent request and compute the round-trip time of the request. It should parse the Path Label value and decode the reply's payload to parse the sender's name and signature. The client should verify that both the received message and the forwarder's name have been signed by the key of the forwarder, whose name is included in the payload of the reply (by fetching this forwarder's public key and verifying the contained signature). In the case that the client receives a PT_TR_REPLY Code TLV with a valid value, it can stop sending requests with increasing HopLimit values and potentially start a new traceroute session.¶
In the case that a traceroute reply is not received for a request within a certain time interval (lifetime of the request), the client should time out and send a new request with a new nonce value up to a maximum number of requests to be sent specified by the user.¶