MPLS echo requests are routed solely by their label stack; the IP destination address is never used in a forwarding decision. This is a deliberate choice so that the probe validates the data plane directly, even when the sender may not know the address of the LSP's egress router a priori.

mpls

The 127/8 address range was chosen for echo request destination addresses because RFC 1122 requires hosts to silently discard such packets (preventing accidental delivery to end users if an LSP breaks), RFC 1812 prevents routers from IP-forwarding them, and the 16M address space provides sufficient variation to exercise all ECMP paths by varying the destination address.

mpls, ip

The Generic IPv4/IPv6 Prefix FEC sub-types (14-15) exist for inter-AS LSPs where the signaling protocol may be LDP in one AS, RSVP-TE in another, and BGP between ASes — making it impractical to name a specific protocol. This decouples LSP ping from needing to know which control-plane protocol established a label binding.

mpls

The Nil FEC sub-TLV (sub-Type 16) was introduced because labels from the reserved range (e.g., Router Alert, Explicit-null) added for diagnostic purposes such as load-balancing influence have no explicit FEC. The Nil FEC provides a placeholder so the Target FEC Stack can account for such labels and proper validation can still be performed.

mpls

This document updates RFC 1122: MPLS echo request packets use destination addresses from the 127/8 range outside a host, which RFC 1122 prohibits. The exception is explicitly required to enable LSP ping to exercise ECMP paths and to prevent diagnostic packets from being IP-forwarded if an LSP is broken.

mpls, ip

An MPLS echo request is delivered to the control plane when triggered by: Router Alert option, IP TTL expiration, MPLS TTL expiration, MPLS Router Alert label, or destination address in the 127/8 range. The control plane further identifies it by UDP destination port 3503.

mpls

An MPLS echo request MUST have a Target FEC Stack TLV describing the FEC Stack being tested. The Return Code and Subcode in the request are set to zero. In traceroute mode, the echo request SHOULD include a Downstream Mapping TLV.

mpls

If the interface to the downstream LSR is unnumbered and the LSR does not know its neighbor's IP address, it MUST set Downstream IP Address to 127.0.0.1 (IPv4) or 0::1 (IPv6) with interface index 0. An LSR receiving either of these addresses MUST bypass interface verification but continue label validation.

mpls

If the originator sets Downstream IP Address to the all-routers multicast address (224.0.0.2 for IPv4, FF02::2 for IPv6) with interface index 0, the receiving LSR MUST bypass both interface and label stack validation but return Downstream Mapping TLVs using its local information.

mpls

In ping mode (end-to-end connectivity check), the TTL in the outermost label is set to 255. In traceroute mode (fault isolation), the TTL is set successively to 1, 2, and so on. The sender SHOULD increment the Sequence Number by 1 for subsequent echo requests.

mpls

The FEC 128 deprecated sub-TLV (sub-Type 9) SHOULD be accepted and processed by implementations, but new echo requests SHOULD use the current sub-TLV (sub-Type 10) unless explicitly configured otherwise. An LSR receiving the deprecated TLV SHOULD use the echo request's source IP address to infer the sender's PE address.

mpls

TLV Types less than 32768 (high-order bit = 0) are mandatory and MUST either be supported or cause the router to return code 2 ('One or more of the TLVs was not understood'). Types ≥ 32768 (high-order bit = 1) are optional and SHOULD be ignored if not understood.

mpls

When Downstream Mapping Multipath Information is non-null, subsequent probe labels and IP addresses MUST be picked from the set provided. If none map to a particular downstream interface, that interface's Multipath Type MUST be set to 0. If Multipath Information is null (length 0 or all-zero mask), the type MUST be set to 0.

mpls

When sending an MPLS echo request: source IP is a routable address of the sender; destination IP is a randomly chosen address from 127/8 (IPv4) or 0:0:0:0:0:FFFF:127/104 (IPv6); IP TTL is set to 1; destination UDP port is 3503; the Router Alert option MUST be set in the IP header.

mpls

When testing LSPs that carry MPLS payloads (L2VPN, L3VPN), the echo request SHOULD be encapsulated with at least one additional label using the Nil FEC to prevent penultimate-hop-popping from allowing the packet to escape via an unlabeled interface, which would mask certain LSP breakages.

mpls

Downstream Mapping Multipath Types: 0=no multipath (empty), 2=IP address list, 4=IP address ranges (low/high pairs, non-overlapping, ascending), 8=bit-masked IP address set (base prefix + bitmask, max prefix length 27), 9=bit-masked label set (same encoding). IPv4 multipath addresses are drawn from 127/8; IPv6 from 0:0:0:0:0:FFFF:127/104.

mpls

Interface and Label Stack TLV (Type 7) MAY be included in a reply to report the interface on which the echo request was received and the label stack as it was received. If any TTL values were changed by the reporting router, they SHOULD be restored. The Address Type field (1-4) distinguishes IPv4/IPv6 numbered/unnumbered interfaces.

mpls

Message Types: 1=MPLS echo request, 2=MPLS echo reply. Reply Modes: 1=Do not reply, 2=Reply via IPv4/IPv6 UDP packet, 3=Reply via UDP with Router Alert, 4=Reply via application level control channel. The echo reply uses the same IP version as the received echo request.

mpls

Return Codes set by the receiver: 0=no code, 1=malformed, 2=TLV not understood, 3=egress for FEC at stack-depth <RSC>, 4=no mapping for FEC at stack-depth <RSC>, 5=Downstream Mapping Mismatch, 8=label switched at stack-depth <RSC>, 10=mapping not the given label, 11=no label entry at stack-depth <RSC>, 13=premature termination due to label stack shrinking to single label.

mpls

Target FEC Stack TLV (Type 1) is a list of sub-TLVs ordered to match the label stack (first sub-TLV corresponds to top of stack), with 16 defined sub-types: LDP IPv4/IPv6 prefix (1-2), RSVP IPv4/IPv6 LSP (3-4), VPN IPv4/IPv6 prefix (6-7), L2 VPN endpoint (8), FEC 128 Pseudowire deprecated/current (9-10), FEC 129 Pseudowire (11), BGP labeled IPv4/IPv6 prefix (12-13), Generic IPv4/IPv6 prefix (14-15), Nil FEC (16).

mpls

IANA maintains registries for LSP ping: Message Types (1=echo request, 2=echo reply; vendor-private range 3-127), Reply Modes (1-4 defined; vendor-private range 5-251), Return Codes (0-13 defined; vendor-private range 192-247), and TLV Types (Types 1-10 assigned; types 32768-65535 are optional). Vendor-private codepoints require a Vendor Enterprise Number TLV in the message.

mpls, registry

MPLS echo requests processed by the control plane could be exploited for denial-of-service attacks by sending large volumes to transit LSRs. The 127/8 destination address scheme limits packet escape from the MPLS network, but implementations should apply rate limiting on control-plane processing of echo requests to protect against resource exhaustion.

mpls, security

FEC validation processing at the receiving LSR iterates over the received label stack (Stack-R): for each Label-L at Label-stack-depth, look up in the ILM; if no entry return code 11 (no label entry); if 'pop and continue' decrement depth and loop; if 'swap or pop-and-switch' set return code 8 (label switched) and check Downstream Mapping; if Label-stack-depth reaches 0 set return code 3 (egress). Best-return-code tracks the most informative result across all stack depths.

mpls

Downstream Mapping TLV (Type 2): 2-octet MTU, 1-octet Address Type (IPv4/IPv6 numbered/unnumbered), 1-octet DS Flags (I=request Interface and Label Stack object, N=treat as non-IP packet), 4 or 16-octet Downstream IP Address, 4 or 16-octet Downstream Interface Address, 1-octet Multipath Type, 1-octet Depth Limit, 2-octet Multipath Length, variable Multipath Information, then N×(24-bit label+EXP+S + 8-bit Protocol).

mpls

FEC 128 Pseudowire current sub-TLV (sub-Type 10, Length 14): 4-octet Sender's PE Address, 4-octet Remote PE Address, 4-octet PW ID (non-zero 32-bit connection ID), 2-octet PW Type (15-bit encapsulation type right-justified, high-order bit zero), 2-octet MBZ. The deprecated variant (sub-Type 9) omits the sender's PE address.

mpls

LDP IPv4 Prefix sub-TLV (sub-Type 1, Length 5): 4-octet IPv4 prefix in network byte order plus 1-octet prefix length in bits; trailing bits SHOULD be set to zero if prefix is shorter than 32 bits. LDP IPv6 Prefix (sub-Type 2, Length 17): same pattern with 16-octet IPv6 prefix.

mpls

MPLS echo request/reply fixed header: 2-octet Version Number (currently 1), 2-octet Global Flags (V bit for FEC Stack validation, rest MBZ), 1-octet Message Type, 1-octet Reply Mode, 1-octet Return Code, 1-octet Return Subcode, 4-octet Sender's Handle, 4-octet Sequence Number, 8-octet TimeStamp Sent (NTP seconds + microseconds), 8-octet TimeStamp Received, followed by variable-length TLVs.

mpls

TLV format: 2-octet Type, 2-octet Length (value field in octets), variable-length Value zero-padded to 4-octet boundary. TLVs may be nested as sub-TLVs, which MUST also be 4-octet aligned.

mpls

VPN IPv4 Prefix sub-TLV (sub-Type 6, Length 13): 8-octet Route Distinguisher (opaque), 4-octet IPv4 prefix, 1-octet prefix length. VPN IPv6 Prefix (sub-Type 7, Length 25): 8-octet RD, 16-octet IPv6 prefix, 1-octet prefix length. The RD is treated as an opaque value when matching local FEC information.

mpls