Explicit Congestion Marking in MPLS
updated by
- rfc-5462 — Multiprotocol Label Switching (MPLS) Label Stack Entry: "EXP" Field Renamed to "Traffic Class" Field
updates
- rfc-3032 — MPLS Label Stack Encoding
Extracted elements (25)
ECN marking uses codepoints rather than dedicated bits in the EXP field because not every PHB requires ECN, assigning a dedicated bit would waste codepoint space, and some PHBs may need more than one ECN-like codepoint (e.g., PCN with admission-marked and termination-marked states).
Per-domain ECT checking was preferred over access-time ECT checking (inspecting the IP header at each hop) because finding an IP header beneath an arbitrary MPLS label stack is unreliable—especially when non-IP payloads are carried—and because many commercial LSRs access the IP header for ECMP anyway, making egress-only checking a minor incremental cost.
The per-domain ECT checking approach was chosen over Floyd's bit-overloading scheme (ECT/CE sharing one bit) because pre-congestion notification scenarios have non-negligible marking rates; the overloading approach would cause unnecessary packet drops even for ECN-capable transports at a rate equal to the product of local and upstream marking probabilities.
Unlike RFC 3168's 'full functionality' tunnel mode (which does not copy CE from inner to outer header at ingress), this document copies CE into the outer MPLS EXP field. This gives interior LSRs visibility into upstream marking, which is necessary for mechanisms like PCN flow termination that must avoid re-marking already-marked packets.
ECN codepoint selection is independent of the Diffserv tunneling model (uniform, short pipe, or pipe as defined in RFC 3270). The tunneling model governs PHB encoding in the EXP value; the choice of CM vs. Not-CM codepoint for ECN always follows the procedures in Section 4 regardless of which model is in use.
The behavior specified in Section 4 resembles RFC 3168's 'full functionality' tunnel mode but differs in that CE information is conveyed from inner to outer header at tunnel ingress, consistent with RFC 4301 (IPsec) which also copies ECN from inner to outer header.
When an MPLS domain uses E-LSPs (EXP-Inferred-PSC LSPs), EXP codepoint space is scarce since all 8 values are partitioned among PHBs and ECN states. With L-LSPs (Label-Only-Inferred-PSC LSPs), the EXP field is largely free for ECN, enabling more sophisticated marking schemes with more codepoints.
An operator MUST NOT enable ECN unless all egress routers in the domain are ECN-capable, because legacy egress routers cannot correctly perform the per-domain ECT checking required by this specification.
Any single LSR within an MPLS domain MUST NOT be configured to enable ECN marking unless all egress LSRs surrounding it are already configured to handle ECN marking.
If congestion notification in the MPLS header is to be copied into the encapsulated IP header, the procedure MUST conform to the specification given in this document.
If the transport for a congestion-marked MPLS packet is found not to be ECN-capable at the egress node, the packet MUST be dropped at that egress node.
In a network using L-LSPs, ECN marking SHOULD NOT cause packets from the same microflow with different ECN markings to be sent on different LSPs, since this could cause misordering. ECN marking on L-LSPs SHOULD only affect the EXP value.
In an ECN-disabled MPLS domain, ECN MUST NOT be enabled on any LSR. Congested LSRs in such a domain MUST drop packets; they MUST NOT mark them. The algorithm for deciding when to drop (tail-drop, RED, etc.) is a local matter.
When a CM-state MPLS packet crosses from an ECN-enabled domain to a non-ECN-enabled domain, egress checking MUST be performed: if the encapsulated packet is not ECN-capable, the packet MUST be dropped. The egress LSR must be able to inspect beneath the MPLS header without popping the label stack.
When the last MPLS label is popped and the payload is non-IP (or lacks ECT capability), it is treated as Not-ECT: if the EXP field was CM, the packet MUST be dropped. Similarly, a Not-ECT IP packet MUST be dropped if the EXP field is CM.
An ECN-enabled MPLS domain is one in which all egress LSRs are configured to perform per-domain ECT checking. Interior LSRs may lack ECN capability; only egress LSRs (or penultimate-hop routers when PHP is used) must be ECN-capable.
ECN marking in MPLS uses codepoints in the 3-bit EXP field of the MPLS shim header. For each PHB that uses ECN, one codepoint is defined as Not Congestion Marked (Not-CM) and at least one as Congestion Marked (CM), consuming at least two EXP codepoints per ECN-capable PHB.
For Pre-Congestion Notification (PCN) support in MPLS, three EXP codepoints per PCN-capable PHB are needed: Not Marked (NM), Admission Marked (AM), and Termination Marked (TM). State transitions are NM→AM, NM→TM, and AM→TM only; TM is sticky and overrides all other states.
When an interior LSR experiences congestion and the packet's EXP codepoint maps to an ECN-capable PHB, the CM state is set in the EXP field irrespective of whether the packet is already in the CM state. If the buffer is full, the packet is dropped.
When encapsulating an IP packet with MPLS labels, the Not-CM state is set in the EXP field if the IP ECN status is Not-ECT, ECT(0), or ECT(1). The CM state is set if the IP ECN status is CE. If multiple labels are pushed simultaneously, the same EXP value is placed in all label stack entries.
When popping a non-final MPLS label, ECN state is transferred from the outer to the inner EXP field: if the inner is Not-CM, it is set to match the outer (CM or Not-CM); if the inner is CM, it remains CM regardless of the outer. An inner-CM/outer-Not-CM combination is anomalous and SHOULD be logged.
When pushing additional MPLS labels onto an already-labeled packet, the EXP field is copied directly from the topmost label before the push to all newly added outer labels.
When the last MPLS label is popped and the IP header is to carry ECN onward, the IP ECN field is set to CE if the EXP field was CM. If the EXP field was Not-CM, the IP ECN field remains unchanged regardless of its current value (Not-ECT, ECT(0), ECT(1), or CE).
Malicious sources could set ECT in IP packets to prevent LSRs from dropping them, which is equivalent to exploiting the per-domain ECT checking design. The authors concluded this is not a new vulnerability because the same effect is achievable simply by setting ECT in the first place, independent of MPLS ECN marking.
The ECN nonce (RFC 3540) works correctly across an MPLS domain without requiring any specific support from this specification. The nonce in the IP header is overwritten when congestion is experienced by an LSR, allowing the sender to detect a misbehaving receiver. An MPLS-shim-level nonce is not required for this purpose.