Bidirectional Forwarding Detection (BFD) for IPv4 and IPv6 (Single Hop)
draft-ietf-bfd-rfc5881bis-01
| Document | Type | Active Internet-Draft (bfd WG) | |
|---|---|---|---|
| Authors | Dave Katz , David Ward , Alvaro Retana | ||
| Last updated | 2026-08-04 (Latest revision 2026-06-23) | ||
| RFC stream | Internet Engineering Task Force (IETF) | ||
| Intended RFC status | (None) | ||
| Formats | |||
| Additional resources |
GitHub Repository
Mailing list discussion |
||
| Stream | WG state | WG Document | |
| Associated WG milestone |
|
||
| Document shepherd | (None) | ||
| IESG | IESG state | I-D Exists | |
| Consensus boilerplate | Unknown | ||
| Telechat date | (None) | ||
| Responsible AD | (None) | ||
| Send notices to | (None) |
draft-ietf-bfd-rfc5881bis-01
Network Working Group D. Katz
Internet-Draft HPE
Obsoletes: 5881 (if approved) D. Ward
Intended status: Standards Track
Expires: 25 December 2026 A. Retana, Ed.
Futurewei Technologies, Inc.
23 June 2026
Bidirectional Forwarding Detection (BFD) for IPv4 and IPv6 (Single Hop)
draft-ietf-bfd-rfc5881bis-01
Abstract
This document describes the use of the Bidirectional Forwarding
Detection (BFD) protocol over IPv4 and IPv6 for single IP hops.
This document obsoletes RFC 5881.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on 25 December 2026.
Copyright Notice
Copyright (c) 2026 IETF Trust and the persons identified as the
document authors. All rights reserved.
Katz, et al. Expires 25 December 2026 [Page 1]
Internet-Draft BFD for IPv4 and IPv6 (Single Hop) June 2026
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents (https://trustee.ietf.org/
license-info) in effect on the date of publication of this document.
Please review these documents carefully, as they describe your rights
and restrictions with respect to this document. Code Components
extracted from this document must include Revised BSD License text as
described in Section 4.e of the Trust Legal Provisions and are
provided without warranty as described in the Revised BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
1.1. Conventions Used in This Document . . . . . . . . . . . . 3
2. Applications and Limitations . . . . . . . . . . . . . . . . 3
3. Initialization and Demultiplexing . . . . . . . . . . . . . . 4
4. Encapsulation . . . . . . . . . . . . . . . . . . . . . . . . 4
5. TTL/Hop Limit Issues . . . . . . . . . . . . . . . . . . . . 5
6. Addressing Issues . . . . . . . . . . . . . . . . . . . . . . 5
7. BFD for Use with Tunnels . . . . . . . . . . . . . . . . . . 6
8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 6
9. Security Considerations . . . . . . . . . . . . . . . . . . . 6
10. References . . . . . . . . . . . . . . . . . . . . . . . . . 6
10.1. Normative References . . . . . . . . . . . . . . . . . . 6
10.2. Informative References . . . . . . . . . . . . . . . . . 7
Appendix A. Implementation Status . . . . . . . . . . . . . . . 8
A.1. [Organization Name] . . . . . . . . . . . . . . . . . . . 8
Appendix B. Change Log . . . . . . . . . . . . . . . . . . . . . 9
B.1. Version -00 . . . . . . . . . . . . . . . . . . . . . . . 9
B.2. Version -01 . . . . . . . . . . . . . . . . . . . . . . . 10
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 10
1. Introduction
One very desirable application for Bidirectional Forwarding Detection
(BFD) [RFC5880] is to track IPv4 and IPv6 connectivity between
directly connected systems. This could be used to supplement the
detection mechanisms in routing protocols or to monitor router-host
connectivity, among other applications.
This document describes the particulars necessary to use BFD in this
environment. Interactions between BFD and other protocols and system
functions are described in the BFD Generic Applications document
[RFC5882].
This document obsoletes [RFC5881].
Katz, et al. Expires 25 December 2026 [Page 2]
Internet-Draft BFD for IPv4 and IPv6 (Single Hop) June 2026
1.1. Conventions Used in This Document
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in BCP
14 [RFC2119] [RFC8174] when, and only when, they appear in all
capitals, as shown here.
2. Applications and Limitations
This application of BFD can be used by any pair of systems
communicating via IPv4 and/or IPv6 across a single IP hop that is
associated with an incoming interface. This includes, but is not
limited to, physical media, virtual circuits, and tunnels.
Each BFD session between a pair of systems MUST traverse a separate
network-layer path in both directions. This is necessary for
demultiplexing to work properly, and also because (by definition)
multiple sessions would otherwise be protecting the same path.
If BFD is to be used in conjunction with both IPv4 and IPv6 on a
particular path, a separate BFD session MUST be established for each
protocol (and thus encapsulated by that protocol) over that link.
If the BFD Echo function is used, transmitted packets are immediately
routed back towards the sender on the interface over which they were
sent. This may interact with other mechanisms that are used on the
two systems that employ BFD. In particular, ingress filtering
[BCP38] is incompatible with the way Echo packets need to be sent.
Implementations that support the Echo function MUST ensure that
ingress filtering is not used on an interface that employs the Echo
function or make an exception for ingress filtering Echo packets.
An implementation of the Echo function also requires Application
Programming Interfaces (APIs) that may not exist on all systems. A
system implementing the Echo function MUST be capable of sending
packets to its own address, which will typically require bypassing
the normal forwarding lookup. This typically requires access to APIs
that bypass IP-layer functionality.
Please note that BFD is intended as an Operations, Administration,
and Maintenance (OAM) mechanism for connectivity check and connection
verification. It is applicable for network-based services (e.g.
router-to-router, subscriber-to-gateway, LSP/circuit endpoints, and
service appliance failure detection). In these scenarios it is
required that the operator correctly provision the rates at which BFD
is transmitted to avoid congestion (e.g link, I/O, CPU) and false
failure detection. It is not applicable for application-to-
Katz, et al. Expires 25 December 2026 [Page 3]
Internet-Draft BFD for IPv4 and IPv6 (Single Hop) June 2026
application failure detection across the Internet because it does not
have sufficient capability to do necessary congestion detection and
avoidance and therefore cannot prevent congestion collapse. Host-to-
host or application-to-application deployment across the Internet
will require the encapsulation of BFD within a transport that
provides "TCP-friendly" [RFC5348] behavior.
3. Initialization and Demultiplexing
In this application, there will be only a single BFD session between
two systems over a given interface (logical or physical) for a
particular protocol. The BFD session must be bound to this
interface. As such, both sides of a session MUST take the "Active"
role (sending initial BFD Control packets with a zero value of Your
Discriminator), and any BFD packet from the remote machine with a
zero value of Your Discriminator MUST be associated with the session
bound to the remote system, interface, and protocol.
4. Encapsulation
BFD Control packets MUST be transmitted in UDP packets with
destination port 3784, within an IPv4 or IPv6 packet. The source
port MUST be in the range 49152 through 65535. The same UDP source
port number MUST be used for all BFD Control packets associated with
a particular session. The source port number SHOULD be unique among
all BFD sessions on the system. If more than 16384 BFD sessions are
simultaneously active, UDP source port numbers MAY be reused on
multiple sessions, but the number of distinct uses of the same UDP
source port number SHOULD be minimized. An implementation MAY use
the UDP port source number to aid in demultiplexing incoming BFD
Control packets, but ultimately the mechanisms in [RFC5880] MUST be
used to demultiplex incoming packets to the proper session.
BFD Echo packets MUST be transmitted in UDP packets with destination
UDP port 3785 in an IPv4 or IPv6 packet. The setting of the UDP
source port is outside the scope of this specification. The
destination address MUST be chosen in such a way as to cause the
remote system to forward the packet back to the local system. The
source address MUST be chosen in such a way as to preclude the remote
system from generating ICMP or Neighbor Discovery Redirect messages.
In particular, the source address SHOULD NOT be part of the subnet
bound to the interface over which the BFD Echo packet is being
transmitted, and it SHOULD NOT be an IPv6 link-local address, unless
it is known by other means that the remote system will not send
Redirects.
Katz, et al. Expires 25 December 2026 [Page 4]
Internet-Draft BFD for IPv4 and IPv6 (Single Hop) June 2026
BFD Echo packets MUST be transmitted in such a way as to ensure that
they are received by the remote system. On multiaccess media, for
example, this requires that the destination datalink address
corresponds to the remote system.
The above requirements may require the bypassing of some common IP
layer functionality, particularly in host implementations.
5. TTL/Hop Limit Issues
If BFD authentication is not in use on a session, all BFD Control
packets for the session MUST be sent with a Time to Live (TTL) or Hop
Limit value of 255. All received BFD Control packets that are
demultiplexed to the session MUST be discarded if the received TTL or
Hop Limit is not equal to 255. A discussion of this mechanism can be
found in [RFC5082].
If BFD authentication is in use on a session, all BFD Control packets
MUST be sent with a TTL or Hop Limit value of 255. All received BFD
Control packets that are demultiplexed to the session MAY be
discarded if the received TTL or Hop Limit is not equal to 255. If
the TTL/Hop Limit check is made, it MAY be done before any
cryptographic authentication takes place if this will avoid
unnecessary calculation that would be detrimental to the receiving
system.
In the context of this section, "authentication in use" means that
the system is sending BFD Control packets with the Authentication bit
set and with the Authentication Section included and that all
unauthenticated packets demultiplexed to the session are discarded,
per the BFD base specification.
6. Addressing Issues
Implementations MUST ensure that all BFD Control packets are
transmitted over the one-hop path being protected by BFD.
On a multiaccess network, BFD Control packets MUST be transmitted
with source and destination addresses that are part of the subnet
(addressed from and to interfaces on the subnet).
On a point-to-point link, the source address of a BFD Control packet
MUST NOT be used to identify the session. This means that the
initial BFD packet MUST be accepted with any source address, and that
subsequent BFD packets MUST be demultiplexed solely by the Your
Discriminator field (as is always the case). This allows the source
address to change if necessary. If the received source address
changes, the local system MUST NOT use that address as the
Katz, et al. Expires 25 December 2026 [Page 5]
Internet-Draft BFD for IPv4 and IPv6 (Single Hop) June 2026
destination in outgoing BFD Control packets; rather, it MUST continue
to use the address configured at session creation. An implementation
MAY notify the application that the neighbor's source address has
changed, so that the application might choose to change the
destination address or take some other action. Note that the TTL/Hop
Limit check described in section 5 (or the use of authentication)
precludes the BFD packets from having come from any source other than
the immediate neighbor.
7. BFD for Use with Tunnels
A number of mechanisms are available to tunnel IPv4 and IPv6 over
arbitrary topologies. If the tunnel mechanism does not decrement the
TTL or Hop Limit of the network protocol carried within, the
mechanism described in this document may be used to provide liveness
detection for the tunnel. The BFD authentication mechanism SHOULD be
used and is strongly encouraged.
8. IANA Considerations
Ports 3784 and 3785 were assigned by IANA for use with the BFD
Control and BFD Echo protocols, respectively.
9. Security Considerations
In this application, the use of TTL=255 on transmit and receive,
coupled with an association to an incoming interface, is viewed as
supplying equivalent security characteristics to other protocols used
in the infrastructure, as it is not trivially spoofable. The
security implications of this mechanism are further discussed in
[RFC5082].
The security implications of the use of BFD authentication are
discussed in [RFC5880].
The use of the TTL=255 check simultaneously with BFD authentication
provides a low overhead mechanism for discarding a class of
unauthorized packets and may be useful in implementations in which
cryptographic checksum use is susceptible to denial-of-service
attacks. The use or non-use of this mechanism does not impact
interoperability.
10. References
10.1. Normative References
Katz, et al. Expires 25 December 2026 [Page 6]
Internet-Draft BFD for IPv4 and IPv6 (Single Hop) June 2026
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<https://www.rfc-editor.org/info/rfc2119>.
[RFC5082] Gill, V., Heasley, J., Meyer, D., Savola, P., Ed., and C.
Pignataro, "The Generalized TTL Security Mechanism
(GTSM)", RFC 5082, DOI 10.17487/RFC5082, October 2007,
<https://www.rfc-editor.org/info/rfc5082>.
[RFC5880] Katz, D. and D. Ward, "Bidirectional Forwarding Detection
(BFD)", RFC 5880, DOI 10.17487/RFC5880, June 2010,
<https://www.rfc-editor.org/info/rfc5880>.
[RFC5882] Katz, D. and D. Ward, "Generic Application of
Bidirectional Forwarding Detection (BFD)", RFC 5882,
DOI 10.17487/RFC5882, June 2010,
<https://www.rfc-editor.org/info/rfc5882>.
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
May 2017, <https://www.rfc-editor.org/info/rfc8174>.
10.2. Informative References
[BCP38] Best Current Practice 38,
<https://www.rfc-editor.org/info/bcp38>.
At the time of writing, this BCP comprises the following:
Ferguson, P. and D. Senie, "Network Ingress Filtering:
Defeating Denial of Service Attacks which employ IP Source
Address Spoofing", BCP 38, RFC 2827, DOI 10.17487/RFC2827,
May 2000, <https://www.rfc-editor.org/info/rfc2827>.
[RFC5348] Floyd, S., Handley, M., Padhye, J., and J. Widmer, "TCP
Friendly Rate Control (TFRC): Protocol Specification",
RFC 5348, DOI 10.17487/RFC5348, September 2008,
<https://www.rfc-editor.org/info/rfc5348>.
[RFC5881] Katz, D. and D. Ward, "Bidirectional Forwarding Detection
(BFD) for IPv4 and IPv6 (Single Hop)", RFC 5881,
DOI 10.17487/RFC5881, June 2010,
<https://www.rfc-editor.org/info/rfc5881>.
[RFC7942] Sheffer, Y. and A. Farrel, "Improving Awareness of Running
Code: The Implementation Status Section", BCP 205,
RFC 7942, DOI 10.17487/RFC7942, July 2016,
<https://www.rfc-editor.org/info/rfc7942>.
Katz, et al. Expires 25 December 2026 [Page 7]
Internet-Draft BFD for IPv4 and IPv6 (Single Hop) June 2026
Appendix A. Implementation Status
This section is to be removed before publishing as an RFC.
Note to the RFC Editor: This section may be removed upon publication
as an RFC.
This section documents the [RFC7942] implementation status of this
document.
A.1. [Organization Name]
Organization:
[Organization Name]
Implementation Name:
[Implementation Name]
Description:
[Description]
Maturity:
[Maturity]
Coverage:
* Section 2: Multiple Session Support - [Implemented/Not
Implemented]
* Section 2: IPv4 and IPv6 supported - [Implemented/Not Implemented]
* Section 2: Echo Function - [Implemented/Not Implemented]
* Section 3: Session association with a received Your Discriminator
set to zero - [Implemented/Not Implemented]
* Section 4: UDP destination port 3784 (Control Packets) -
[Implemented/Not Implemented]
* Section 4: UDP source port in the 49152 through 65535 range -
[Implemented/Not Implemented]
* Section 4: Unique UDP source ports - [Implemented/Not Implemented]
* Section 4: UDP destination port 3785 (Echo Packets) -
[Implemented/Not Implemented]
Katz, et al. Expires 25 December 2026 [Page 8]
Internet-Draft BFD for IPv4 and IPv6 (Single Hop) June 2026
* Section 5: Generalized TTL Security Mechanism (authentication not
in use) - [Implemented/Not Implemented]
* Section 5: Generalized TTL Security Mechanism (authentication in
use) - [Implemented/Not Implemented]
* Section 6: Enforce one-hop path - [Implemented/Not Implemented]
* Section 6: Multiaccess Networks - [Implemented/Not Implemented]
* Section 6: Point-to-Point Links - [Implemented/Not Implemented]
* Section 7: Tunnels - [Implemented/Not Implemented]
Licensing:
[Licensing]
Implementation Experience:
[Implementation Experience]
Comments:
[Comments]
Contact Information:
[Contact Information]
Date:
[Date]
Appendix B. Change Log
This section is to be removed before publishing as an RFC.
B.1. Version -00
This initial version is the same as RFC 5881, using the rfcxmlv3
formatting and minimal changes:
* Updated contact information.
* Updated RFC 2119 boilerplate to reflect RFC 8174.
* Updated references.
* Added a change log section.
Katz, et al. Expires 25 December 2026 [Page 9]
Internet-Draft BFD for IPv4 and IPv6 (Single Hop) June 2026
B.2. Version -01
This version includes the following changes from version -00:
* Added an implementation status section.
* Incorporated the Verified Erratum 2293 (https://errata.rfc-
editor.org/eid2293/).
Authors' Addresses
Dave Katz
HPE
Email: david.katz@hpe.com
Dave Ward
Email: dward@bgp.nu
Alvaro Retana (editor)
Futurewei Technologies, Inc.
Email: aretana@futurewei.com
Katz, et al. Expires 25 December 2026 [Page 10]