Network Service Header Timestamping
draft-browne-sfc-nsh-timestamp-00
The information below is for an old version of the document.
| Document | Type |
This is an older version of an Internet-Draft whose latest revision state is "Replaced".
|
|
|---|---|---|---|
| Authors | Rory Browne , Andrey Chilikin , Brendan Ryan , Tal Mizrahi , Yoram Moses | ||
| Last updated | 2015-12-04 | ||
| Replaces | draft-browne-ietf-sfc-nsh-timestamp | ||
| Replaced by | draft-browne-sfc-nsh-kpi-stamp, draft-browne-sfc-nsh-kpi-stamp, RFC 8592 | ||
| RFC stream | (None) | ||
| Formats | |||
| Stream | Stream state | (No stream defined) | |
| Consensus boilerplate | Unknown | ||
| RFC Editor Note | (None) | ||
| IESG | IESG state | I-D Exists | |
| Telechat date | (None) | ||
| Responsible AD | (None) | ||
| Send notices to | (None) |
draft-browne-sfc-nsh-timestamp-00
Network Working Group R. Browne
Internet Draft A. Chilikin
Intended status: Standards Track B. Ryan
Expires: June 2016 Intel
T. Mizrahi
Marvell
Y. Moses
Technion
December 4, 2015
Network Service Header Timestamping
draft-browne-sfc-nsh-timestamp-00.txt
Abstract
This draft describes a method of timestamping Network Service Header
(NSH) encapsulated packets or frames on service chains in order to
measure accurately hop-by-hop performance delays of application flows
carried within the chain. This method may be used to monitor
performance and highlight problems with virtual links (vlinks),
Virtual Network Functions (VNFs) or Physical Network Functions (PNFs)
on the Rendered Service Path (RSP).
Status of this Memo
This Internet-Draft is submitted to IETF in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that
other groups may also distribute working documents as Internet-
Drafts.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt.
The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html.
This Internet-Draft will expire on June 4, 2016.
Browne, et al. Expires June 4, 2016 [Page 1]
Internet-Draft NSH Timestamping December 2015
Copyright Notice
Copyright (c) 2015 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Table of Contents
1. Introduction...................................................2
2. Terminology....................................................3
2.1. Requirement Language......................................3
2.2. Definition of Terms.......................................3
2.3. Abbreviations.............................................5
3. NSH Timestamping...............................................6
3.1. Prerequisites.............................................7
3.2. Operation.................................................8
3.3. Performance Considerations................................9
4. NSH Timestamping Encapsulation................................10
5. Hybrid Models.................................................14
5.1. Targeted VNF Timestamp...................................15
6. Fragmentation Considerations..................................16
7. Security Considerations.......................................16
8. Open Items for WG Discussion..................................17
9. IANA Considerations...........................................17
10. Acknowledgments..............................................17
11. References...................................................17
11.1. Normative References....................................17
11.2. Informative References..................................18
1. Introduction
Network Service Header (NSH), as defined by [NSH], defines a method
to insert a service-aware header in between payload and transport
headers. This allows a great deal of flexibility and programmability
in the forwarding plane allowing user flows to be programmed on-the-
fly for the appropriate Service Functions (SFs).
Browne, et al. Expires June 4, 2016 [Page 2]
Internet-Draft NSH Timestamping December 2015
Whilst NSH promises a compelling vista of operational agility for
Service Providers, many service providers are concerned about losing
service visibility in the transition from physical appliance SFs to
virtualized SFs running in the Network Function Virtualization (NFV)
domain. This concern increases when we consider that many service
providers wish to run their networks seamlessly in 'hybrid' mode,
whereby they wish to mix physical and virtual SFs and run services
seamlessly between the two domains.
This draft describes a generic method to monitor and debug service
chains and application performance of the flows within a service
chain. This method is compliant with hybrid architectures in which
VNFs and PNFs are freely mixed in the service chain. This method also
is flexible to monitor the performance of an entire chain or part
thereof as desired. Please refer to [NSH] as background architecture
for the method described in this document.
The method described in this draft is not an OAM protocol like
[Y.1731] or [Y.1564] for example. As such it does not define new OAM
packet types or operation. Rather it monitors the service chain
performance for subscriber payloads and indicates subscriber QoE
rather than out-of-band infrastructure metrics.
2. Terminology
2.1. Requirement Language
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [RFC2119].
2.2. Definition of Terms
Classification: Locally instantiated policy and
customer/network/service profile matching of traffic flows for
identification of appropriate outbound forwarding actions.
First TS Node (FTSN): Must mark packet correctly. Must understand 5
tuple information in order to match TS Controller flow table.
Last TS Node (LTSN): must read all MD & export to system performance
statistics agent or repository. Should also send NSH header - the
Service Index (SI) will indicate if a PNF(s) was at the end of the
chain. The LTSN changes the SPI in order that the underlay routes the
metadata back directly to the TSDB.
Browne, et al. Expires June 4, 2016 [Page 3]
Internet-Draft NSH Timestamping December 2015
Network Node/Element: Device that forwards packets or frames based
on outer header information. In most cases is not aware of the
presence of NSH.
Network Overlay: Logical network built on top of existing network
(the underlay). Packets are encapsulated or tunneled to create the
overlay network topology.
Network Service Header: Data plane header added to frames/packets.
The header contains information required for service chaining, as
well as metadata added and consumed by network nodes and service
elements.
NSH Proxy: Acts as a gateway: removes and inserts SH on behalf of a
service function that is not NSH aware.
Service Classifier: Function that performs classification and
imposes an NSH. Creates a service path. Non-initial (i.e.
subsequent) classification can occur as needed and can alter, or
create a new service path.
Service Function (SF): A function that is responsible for specific
treatment of received packets. A service function can act at the
network layer or other OSI layers. A service function can be virtual
instance or be embedded in a physical network element. One of
multiple service functions can be embedded in the same network
element. Multiple instances of the service function can be enabled in
the same administrative domain.
Service Function Chain (SFC): A service function chain defines an
ordered set of service functions that must be applied to packets
and/or frames selected as a result of classification. The implied
order may not be a linear progression as the architecture allows for
nodes that copy to more than one branch. The term service chain is
often used as shorthand for service function chain.
Service Function Path (SFP): The instantiation of a SFC in the
network. Packets follow a service function path from a classifier
through the requisite service functions.
TS Controller: The TS Controller may be part of the service chaining
application, SDN controller, NFVO or any MANO entity. For clarity we
define the TS Controller separately here as the central logic that
decides what packets to timestamp and how. The TS Controller
instructs the classifier on how to mark the NSH header.
Browne, et al. Expires June 4, 2016 [Page 4]
Internet-Draft NSH Timestamping December 2015
Timestamp Control Plane (TSCP): the control plane between the FTSN
and the TS Controller.
Timestamp Database (TSDB): external storage of Metadata for
reporting, trend analysis etc.
2.3. Abbreviations
FTSN First Timestamp Node
LTSN Last Timestamp Node
MD Metadata
NFV Network Function Virtualization
NFVI-PoP NFV Infrastructure Point of Presence
NIC Network Interface Card
NSH Network Service Header
OAM Operations, Administration, and Maintenance
PNF Physical Network Function
PNFN Physical Network Function Node
QoE Quality of Experience
RSP Rendered Service Path
SCL Service Classifier
SI Service Index
SF Service Function
SFC Service Function Chain
SFN Service Function Node
SFP Service Function Path
TS Timestamp
TSCP Timestamp Control Plane
Browne, et al. Expires June 4, 2016 [Page 5]
Internet-Draft NSH Timestamping December 2015
TSDB Timestamp Database
TSSI Timestamp Service Index
VNF Virtual Network Function
vSwitch Virtual Switch
3. NSH Timestamping
As a generic architecture, please refer to Figure 1 below.
TS
Controller
| TSDB
| TSCP Interface |
,---. ,---. ,---. ,---.
/ \ / \ / \ / \
( SCL )-------->( SF1 )--------->( SF2 )--------->( SFN )
\ FTSN/ \ / \ / \ LTSN/
`---' `---' `---' `---'
Figure 1 Logical roles in NSH Timestamping
The TS Controller will most probably be part of the SFC controller
but is explained separately in this document for clarity. The TS
Controller is responsible for initiating start/stop timestamp
requests to the SCL or FTSN, and also for distributing timestamp NSH
policy into the service chain via the Timestamping Control Plane
(TSCP) interface.
The First Timestamp Node (FTSN) will typically be part of the SCL but
again is called out as separate logical entity for clarity. The FTSN
is responsible for marking NSH MD Type 0x2 fields for the correct
flow with the appropriate NSH fields. This tells all upstream nodes
how to behave in terms of timestamping at VNF ingress, egress or
both, or ignoring the timestamp NSH metadata completely. The FTSN
also writes the Reference Time value, a (possibly inaccurate)
estimate of the current time-of-day, into the header, allowing the
{chain,flow} performance to be compared to previous samples for
offline analysis. The FTSN should return an error to the TS
Controller if not synchronized to the current time-of-day and forward
the packet along the service-chain unchanged.
SF1, SF2 timestamp the packets as dictated by the FTSN and process
the payload as per normal.
Browne, et al. Expires June 4, 2016 [Page 6]
Internet-Draft NSH Timestamping December 2015
Note 1: The exact location of the timestamp creation may not be in
the VNF itself, as referenced in Section 3.3.
Note 2: Special cases exist where some of the SFs (PNFs or VNFs) are
NSH-unaware. This is covered in Section 5.
The Last Timestamp Node (LTSN) should strip the entire header and
forward the packet to the IP next hop. The LTSN also exports NSH
timestamp information to the Timestamp Database (TSDB) for offline
analysis; the LTSN may either export the timestamping information of
all packets, or a subset based on packet sampling. In fully
virtualized environments the LTSN will be co-located with the VNF
that decrements the NSH Service Index to zero. Corner cases exist
whereby this is not the case and is covered in section 5.
3.1. Prerequisites
In order to guarantee metadata accuracy, all servers hosting VNFs
should be synchronized from a centralized stable clock. As PNFs do
not timestamp there is no need for them to synchronize. There are two
possible levels of synchronization:
Level A: Low accuracy time-of-day synchronization, based on
NTP [RFC5905].
Level B: High accuracy synchronization (typically on the order of
microseconds), based on [IEEE1588].
Each platform SHOULD have a level A synchronization, and MAY have a
level B synchronization.
Level A requires each platform (including the TS Controller) to
synchronize its system real-time-clock to an NTP server. This is used
to mark the metadata in the chain, using the <Reference Time> field
in the NSH timestamp header (Section 4.). This timestamp is written
to the NSH header by the first SF in the chain. NTP accuracy can vary
by several milliseconds between locations. This is not an issue as
the Reference Time is merely being used as a reference inserted into
the TSDB for performance monitoring.
Level B synchronization requires each platform to be synchronized to
a Primary Reference Clock (PRC) using the Precision Time Protocol
[IEEE1588]. A platform MAY also use Synchronous Ethernet ([G.8261],
[G.8262], [G.8264]), allowing more accurate frequency
synchronization.
Browne, et al. Expires June 4, 2016 [Page 7]
Internet-Draft NSH Timestamping December 2015
If a SF is not synchronized at the moment of timestamping, it should
indicate synch status in the NSH header. This is described in more
detail in section 4.
By synchronizing the network in this way, the timestamping operation
is independent of the current RSP, whether the entire chain is served
by one NFVI-PoP or by multiple. Indeed the timestamp MD can indicate
where a chain has been moved due to a resource starvation event as
indicated in Figure 2 below, between VNF 3 and VNF 4 at time B.
Delay
| v
| v
| x
| x x = reference time A
| xv v = reference time B
| xv
| xv
|______|______|______|______|______|_____
VNF1 VNF2 VNF3 VNF4 VNF5
Figure 2 Flow performance in a service chain
3.2. Operation
Section 3.5 of [NSH] defines NSH metadata type 2 encapsulation as per
the figure below. Please refer to the draft for a detailed
explanation. Timestamped flows will use this format.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Ver|O|C|R|R|R|R|R|R| Length | MD-type=0x2 | Next Protocol |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Service Path ID | Service Index |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| TLV Class | Type |R|R|R| Len |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Variable Metadata |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 3 NSH MD type 2 Encapsulation
Flow Selection
Browne, et al. Expires June 4, 2016 [Page 8]
Internet-Draft NSH Timestamping December 2015
The TS Controller should maintain a list of flows within each service
chain to be monitored. This flow table should be in the format SPI:5
tuple ID. The TS Controller should map these pairs to unique Flow IDs
per service chain within the extended NSH header specified in this
draft. The TS Controller should instruct the FTSN to initiate
timestamping on flow table match. The TS Controller may also tell the
classifier the duration of the timestamping operation, either by a
number of packets in the flow or by a time duration.
In this way the system can monitor the performance of the all en-
route traffic, or an individual subscriber in a chain, or just a
specific application the subscriber is running.
The TS Controller should write the list of monitored flows into the
TSDB for correlation of performance data. Thus, when the TSDB
receives data from the LTSN it understands to which flow the data
pertains.
The association of source IP to subscriber identity is outside the
scope of this draft and will vary by network application. For
example, the method of association of a source IP to IMSI in mobile
cores will be different to how a CPE with NAT function may be chained
in an enterprise NFV application.
TSCP Interface
A new timestamp control plane (TSCP) interface is required between
the TS Controller and the FTSN or classifier. This interface:
o Communicates which chains and flows to timestamp. This can be a
specific {chain,flow} combination or include wildcards for
monitoring subscribers across multiple chains or multiple flows
within one chain.
o How the timestamp should be applied (ingress, egress, both or
specific).
o When to stop timestamping.
Exact specification of TSCP is for further study.
3.3. Performance Considerations
This draft does not mandate a specific timestamping implementation
method, and thus NSH timestamping can either be performed by hardware
mechanisms, or by software. If software-based timestamping is used,
applying and operating on the timestamps themselves incur an
Browne, et al. Expires June 4, 2016 [Page 9]
Internet-Draft NSH Timestamping December 2015
additional small delay in the service chain. However, it can be
assumed that these additional delays are all relative for the flow in
question. Thus, whist the absolute timestamps may not be fully
accurate for normal non-timestamped traffic they can be assumed to be
relative.
It is assumed that the monitoring method described in this document
would only operate on a small percentage of user flows. The service
provider may choose a flexible policy in the TS Controller to
timestamp a selection of user-plane every minute for example to
highlight any performance issues. Alternatively, the LTSN may
selectively export a subset of the timestamps it receives, based on a
predefined sampling method. Of course the TS Controller can stress
test an individual flow or chain should a deeper analysis be
required. We can expect that this type of deep analysis has an impact
on the performance of the chain itself whilst under investigation.
The impact will be dependent on vendor implementation and outside the
scope of this document.
The timestamp may be applied at various parts of the NFV
architecture. The VNF, hypervisor (assuming no SRIOV pass-through),
vSwitch or NIC are all potential locations that can append the packet
with the requested timestamp. Whilst it is desirable to timestamp as
close as possible to the VNF for performance accuracy, the exact
location of the timestamp application is outside the scope of this
document, but should be consistent across the individual TS
Controller domain.
4. NSH Timestamping Encapsulation
The NSH timestamping encapsulation is shown below in figure 4:
Browne, et al. Expires June 4, 2016 [Page 10]
Internet-Draft NSH Timestamping December 2015
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Ver|O|C|R|R|R|R|R|R| Length | MD-type=0x2 | NextProto=0x0 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Service Path ID | Service Index |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| TLV Class=0x10 |C| Type=0x01 |R|R|R| Len |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Reference Time |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Syn |R|E|I|TSI|TS Service Indx| Flow ID |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-|
| Ingress Timestamp (I bit is set)(FTSN) |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Egress Timestamp (E bit is set)(FTSN) |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
. .
. .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Syn |R|E|I|TSI|TS Service Indx| Flow ID |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-|
| Ingress Timestamp (I bit is set) |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Egress Timestamp (E bit is set) |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Syn |R|E|I|TSI|TS Service Indx| Flow ID |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-|
| Ingress Timestamp (I bit is set) (LTSN) |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Egress Timestamp (E bit is set) (LTSN) |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 4 NSH Timestamp Encapsulation
Browne, et al. Expires June 4, 2016 [Page 11]
Internet-Draft NSH Timestamping December 2015
Relevant fields in header that the FTSN must implement:
o The O bit should not be set as we are operating on subscriber
packets
o The C bit should be set indicating critical metadata exists
o The MD type must be set to 0x2
o The TLV Class must be set to 0x10 (General KPI Monitoring) as
requested in Section 9. The timestamp type is defined to be 0x01:
o Type = 0x00 Reserved.
o Type = 0x01 Timestamp.
o The MSB of the Type field must be set to zero. Thus if a receiver
along the path does not understand the timestamping protocol it
will pass the packet transparently and not drop. This scheme
allows for extensibility to the mechanism described in this
document to other KPI collections and operations.
The FTSN timestamp metadata contains the Timestamp Service Index
(TSI) field which must be set to one of the following values:
o 0x0 Timestamp mode, no Service index specified in the TS Service
Index field.
o 0x1 Timestamp Hybrid mode is selected, Timestamp Service Index
contains LTSN Service index. This is used when PNFs or NSH-unaware
SFs are used at the tail of the chain. If TSI=0x1, then the value
in the type field informs the chain which SF should act as the
LTSN.
o 0x2 Timestamp Specific mode is selected, Timestamp Service Index
contains the targeted Service Index. In this case E&I bits are
ignored and the Timestamp Service Index field indicates which SF
is to be timestamped. Both ingress and egress timestamps are
performed when the SI=TSSI on the chain. In this mode the FTSN
will also apply the Reference Time and Ingress Timestamp. This
will indicate the delay along the service chain to the targeted
SF.
Browne, et al. Expires June 4, 2016 [Page 12]
Internet-Draft NSH Timestamping December 2015
o 0x3 Timstamp E2E. In this case E&I bits are again ignores, FTSN
writes ingress timestamp and reference time. This method may also
be used as a light implementation to monitor end-to-end service
chain performance whereby the targeted SF is the LTSN. The
advantage here is very low overhead in the header and quick
notification if there is a chain problem. This could then
instigate a deeper examination of the chain performance.
The Flow ID is a unique 16 bit identifier written into the header by
the classifier. This allow 65536 flows to be concurrently timestamped
on any given NSH service chain (SPI). Flow IDs are not written by
subsequent SFs in the chain. The FTSN exports monitored flow IDs to
the TSDB for correlation.
The E bit should be set if Egress timestamp is requested.
The I bit should be set if Ingress timestamp is requested.
Reference Time is the wall clock of the FTSN, and may be used for
historical comparison of SC performance. If the FTSN is not Level A
synchronized (see Section 3.1.) it should inform the TS controller
over the TSCP interface. The Reference Time is represented in 64-bit
NTP format [RFC5905].
The Syn bits are an indication of the synchronization status of the
node performing the timestamp and must be set to one of the following
values:
o In Synch: 0x00
o In holdover: 0x01 (SF sees synch source and is in process of
synching)
o Out of Synch: 0x02 (SF sees synch source but cannot synch to it)
o In free run: 0x03 (SF does not see acceptable external synch
source)
If the network node is out of synch or in free run no timestamp is
applied by the node (but other timestamp MD is applied) and the
packet is processed normally.
If FTSN is out of synch or in free run timestamp request rejected and
not propagated though the chain. The FTSN should inform the TS
controller in such an event over the TSCP interface.
Browne, et al. Expires June 4, 2016 [Page 13]
Internet-Draft NSH Timestamping December 2015
The outer service index value is copied into the timestamp metadata
to help cater for hybrid chains that's are a mix of VNFs and PNFs or
through SFs that do not understand NSH. Thus if a flow transits
through a PNF or an NSH-unaware node the delta in the inner service
index between timestamps will indicate this.
The Ingress Timestamp and Egress Timestamp are represented in 64-bit
NTP format [RFC5905]. The corresponding bits (I and E) reported in
the timestamp metadata header.
The 64-bit timestamp format [RFC5905] is presented below:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Seconds |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Fraction |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 5 NTP [RFC5905] 64-bit Timestamp Format
5. Hybrid Models
A hybrid chain may be defined as a chain whereby there is a mix of
NSH-aware and NSH-unaware SFs. This may be the case if some PNFs are
used in the chain or if VNFs are used that do not support NSH.
Example 1. PNF in the middle
TS
Controller
| TSDB
| TSCP Interface |
,---. ,---. ,---. ,---.
/ \ / \ / \ / \
( SCL )-------->( SF1 )--------->( SF2 )--------->( SFN )
\ FTSN/ \ / \ PNF1/ \ LTSN/
`---' `---' `---' `---'
Figure 6 Hybrid chain with PNF in middle
In this example the FTSN begins operation and sets the SI to 3, SF1
decrements this to 2 and passes the flow to an SFC proxy (not shown).
Browne, et al. Expires June 4, 2016 [Page 14]
Internet-Draft NSH Timestamping December 2015
The proxy strips the NSH header and passes to the PNF. On receipt
back from the PNF the Proxy decrements the SI and passes the packet
onto the LTSN with a SI=1.
After the LTSN processes the traffic it knows it is the last node on
the chain from the SI value and exports the entire NSH header and all
metadata to the TSDB. The payload is forwarded to the next hop on the
underlay minus the NSH header. The TS information packet is given a
new SPI which acts as a homing tag to transport the timestamp data
back to the TSDB.
Example 2. PNF at the end
TS
Controller
| TSDB
| TSCP Interface |
,---. ,---. ,---. ,---.
/ \ / \ / \ / \
( SCL )-------->( SF1 )--------->( SF2 )--------->( PNFN )
\ FTSN/ \ / \ LTSN/ \ /
`---' `---' `---' `---'
Figure 7 Hybrid Chain with PNF at end
In this example the FTSN begins operation and sets the SI to 3, the
TSI field set to 0x1, and the type to 1. Thus when SF2 receives the
packet with SI=1, it understands that it is expected to take on the
role of the LTSN as it is the last NSH-aware node in the chain.
5.1. Targeted VNF Timestamp
For the majority of flows within the service chain, timestamps
(ingress, egress or both) will be carried out at each hop until the
SI decrements to zero and the NSH header and TS MD is exported to the
TSDB. There may exist however the need to just test a particular VNF
(perhaps after a scale out operation or software upgrade for
example). In this case the FTSN should mark the NSH header as
follows:
TSI field is set to 0x2. Type is set to the expected SI at the SF in
question. When outer SI is equal to the TSSI, timestamps are applied
at SF ingress and egress, and the NSH header and MD are exported to
the TSDB.
Browne, et al. Expires June 4, 2016 [Page 15]
Internet-Draft NSH Timestamping December 2015
6. Fragmentation Considerations
The method described in this draft does not support fragmentation.
The TS Controller should return an error should a timestamping
request from an external system exceed MTU limits and require
fragmentation.
Depending on the length of the payload and the type of timestamp and
chain length, this will vary for each packet.
In most service provider architectures we would expect a SI << 10,
and that may include some PNFs in the chain which do not add
overhead. Thus for typical IMIX packet sizes we expect to able to
perform timestamping on the vast majority of flows without
fragmenting.
7. Security Considerations
The security considerations of NSH in general are discussed in [NSH].
The use of in-band timestamping, as defined in this document, can be
used as a means for network reconnaissance. By passively
eavesdropping to timestamped traffic, an attacker can gather
information about network delays and performance bottlenecks.
The NSH timestamp is intended to be used by various applications to
monitor the network performance and to detect anomalies. Thus, a man-
in-the-middle attacker can maliciously modify timestamps in order to
attack applications that use the timestamp values. For example, an
attacker could manipulate the SFC classifier operation, such that it
forwards traffic through 'better' behaving chains. Furthermore, if
timestamping is performed on a fraction of the traffic, an attacker
can selectively induce synthetic delay only to timestamped packets,
causing systematic error in the measurements.
An attacker that gains access to the TSCP can enable timestamping for
all subscriber flows, thereby causing performance bottlenecks,
fragmentation, or outages.
As discussed in previous sections, NSH timestamping relies on an
underlying time synchronization protocol. Thus, by attacking the time
protocol an attack can potentially compromise the integrity of the
NSH timestamp. A detailed discussion about the threats against time
protocols and how to mitigate them is presented in [RFC7384].
Browne, et al. Expires June 4, 2016 [Page 16]
Internet-Draft NSH Timestamping December 2015
8. Open Items for WG Discussion
o Specification and operation of TSCP
o AOB
9. IANA Considerations
TLV Class Allocation
TLV classes are defined in [NSH].
IANA is requested allocate a new TLV class value:
0x10 KPI General Monitoring and timestamping type.
NSH Timestamping TLV Type
IANA is requested to set up a registry of "NSH Timesamping TLV
Types". These are 7-bit values. Registry entries are assigned by
using the "IETF Review" policy defined in [RFC5226].
IANA is requested to allocate two new types as follows:
o Type = 0x00 Reserved.
o Type = 0x01 Timestamp.
10. Acknowledgments
The authors would like to thank Ron Parker of Affirmed Networks and
Seungik Lee of ETRI for their reviews of this draft.
This document was prepared using 2-Word-v2.0.template.dot.
11. References
11.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[NSH] Quinn, P., Elzur, U., "Network Service Header", draft-
ietf-sfc-nsh-01 (work in progress), July 2015.
Browne, et al. Expires June 4, 2016 [Page 17]
Internet-Draft NSH Timestamping December 2015
11.2. Informative References
[IEEE1588] IEEE TC 9 Instrumentation and Measurement Society,
"1588 IEEE Standard for a Precision Clock
Synchronization Protocol for Networked Measurement and
Control Systems Version 2", IEEE Standard, 2008.
[RFC5226] Narten, T. and H. Alvestrand, "Guidelines for Writing
an IANA Considerations Section in RFCs", BCP 26, RFC
5226, May 2008.
[RFC5905] Mills, D., Martin, J., Burbank, J., Kasch, W.,
"Network Time Protocol Version 4: Protocol and
Algorithms Specification", RFC 5905, June 2010.
[RFC7384] Mizrahi, T., "Security Requirements of Time Protocols
in Packet Switched Networks", RFC 7384, October 2014.
[Y.1731] ITU-T Recommendation G.8013/Y.1731, "OAM Functions and
Mechanisms for Ethernet-based Networks", August 2015.
[Y.1564] ITU-T Recommendation Y.1564, "Ethernet service
activation test methodology", March 2011.
[G.8261] ITU-T Recommendation G.8261/Y.1361, "Timing and
synchronization aspects in packet networks", August
2013.
[G.8262] ITU-T Recommendation G.8262/Y.1362, "Timing
characteristics of a synchronous Ethernet equipment
slave clock", January 2015.
[G.8264] ITU-T Recommendation G.8264/Y.1364, "Distribution of
timing information through packet networks", May 2014.
Authors' Addresses
Rory Browne
Intel
Dromore House
Shannon
Co.Clare
Ireland
Email: rory.browne@intel.com
Browne, et al. Expires June 4, 2016 [Page 18]
Internet-Draft NSH Timestamping December 2015
Andrey Chilikin
Intel
Dromore House
Shannon
Co.Clare
Ireland
Email: andrey.chilikin@intel.com
Brendan Ryan
Intel
Dromore House
Shannon
Co.Clare
Ireland
Email: brendan.ryan@intel.com
Tal Mizrahi
Marvell
6 Hamada St.
Yokneam, 20692 Israel
Email: talmi@marvell.com
Yoram Moses
Department of Electrical Engineering
Technion - Israel Institute of Technology
Technion City, Haifa, 32000, Israel
Email: moses@ee.technion.ac.il
Browne, et al. Expires June 4, 2016 [Page 19]