PROBE: A Utility for Probing Interfaces
updates
- rfc-4884 — Extended ICMP to Support Multi-Part Messages
Extracted elements (22)
PROBE differs from PING in that it does not require bidirectional connectivity between the probing and probed interfaces. Instead, it requires bidirectional connectivity between the probing interface and a proxy interface, enabling diagnostics for unnumbered, unreachable, or address-family-mismatched interfaces.
PROBE supports use cases where PING cannot be used: probing unnumbered interfaces, interfaces with only IPv6 link-local addresses, cross-address-family probing (IPv4-only probing node vs IPv6-only probed interface), or when no route exists from the probing node to the probed interface.
This document updates RFC 4884 by adding the ICMP Extended Echo Request and Extended Echo Reply messages to the list of extensible ICMP messages that can carry the ICMP Extension Structure defined in RFC 4884 Section 4.6.
If the L-bit is clear (probed interface is directly connected to proxy node, not resident on it), the Interface Identification Object MUST identify the probed interface by address rather than by name or index.
The Code field MUST be set to Malformed Query (1) if the Extended Echo Request lacks an ICMP Extension Structure, the Extension Structure lacks exactly one Interface Identification Object, or the L-bit is clear but identification is by ifName or ifIndex.
The ICMP Extension Structure in an Extended Echo Request MUST contain exactly one instance of the Interface Identification Object.
The Source Address of an ICMP Extended Echo Request MUST be a valid IPv4 or IPv6 unicast address, and the Destination Address MUST be a unicast address.
When a node receives an ICMP Extended Echo Request and has not explicitly enabled ICMP Extended Echo functionality, or the source address is not authorized, or the source/destination address conditions are not met, the node MUST silently discard the incoming message.
When responding to an ICMPv4 Extended Echo Request, the node MUST set DF=1, More Fragments=0, Fragment Offset=0, TTL=255, and Protocol=ICMP in the reply.
When responding to an ICMPv6 Extended Echo Request, the node MUST set Hop Limit=255 and Next Header=ICMPv6 in the reply.
The A-bit (Active) in the Extended Echo Reply is set only when Code is No Error, the L-bit was set, and the probed interface is active. The 4-bit and 6-bit indicate whether IPv4 or IPv6 is running on the probed interface, and are only meaningful when A-bit is set.
The L-bit in the Extended Echo Request indicates whether the probed interface resides on the proxy node (L-bit set) or is directly connected to the proxy node (L-bit clear). This determines how the proxy resolves the interface.
The State field in the Extended Echo Reply reflects the ARP table or IPv6 Neighbor Cache entry state when the probed interface is not on the proxy node. Values are: 0=Reserved, 1=Incomplete, 2=Reachable, 3=Stale, 4=Delay, 5=Probe, 6=Failed.
IANA registered ICMP Extension Object Class 3 (Interface Identification Object) with C-Type subregistry: 0=Reserved, 1=Identifies Interface by Name, 2=Identifies Interface by Index, 3=Identifies Interface by Address. C-Type values assigned FCFS in range 0-255.
IANA registered ICMPv4 type 42 (Extended Echo Request) and type 43 (Extended Echo Reply) with associated code subregistries, and ICMPv6 type 160 (Extended Echo Request) and type 161 (Extended Echo Reply) in the informational range 128-255, each with code values 0-4.
Implementations SHOULD rate-limit incoming ICMP Extended Echo Request messages to protect local resources from resource exhaustion.
PROBE can be exploited by malicious parties to discover interface names, which may reveal vendor identity, device type, OS version, and interface bandwidth. To mitigate this, nodes MUST support configuration options to enable/disable Extended Echo functionality, restrict L-bit settings, restrict query types, and restrict source prefixes per query type. By default, Extended Echo functionality is disabled.
To prevent VPN information leakage, when a node receives an ICMP Extended Echo Request where the proxy interface is in a different VPN than the probed interface, the node MUST return an Extended Echo Reply with error code No Such Interface (2).
Code field processing defines five reply states: No Error (0) when query succeeds; Malformed Query (1) when structure or L-bit/identification-type constraints are violated; No Such Interface (2) when L-bit is set but interface not found on proxy; No Such Table Entry (3) when L-bit is clear but address not in ARP/Neighbor Cache; Multiple Interfaces Satisfy Query (4) when multiple interfaces match.
The ICMP Extended Echo Reply message contains Type (43 for ICMPv4, 161 for ICMPv6), Code, Checksum, Identifier, Sequence Number, a 3-bit State field, Reserved bits, A-bit (active), 4-bit (IPv4 running), and 6-bit (IPv6 running).
The ICMP Extended Echo Request message contains a Type field (42 for ICMPv4, 160 for ICMPv6), Code (1 octet), Checksum (2 octets), Identifier (2 octets), Sequence Number (1 octet), Reserved bits, L-bit flag, and an ICMP Extension Structure identifying the probed interface.
The Interface Identification Object (Class-Num 3) identifies a probed interface by name (C-Type 1), index (C-Type 2), or address (C-Type 3). For C-Type 3, the payload contains a 16-bit AFI field, an 8-bit Address Length, an 8-bit Reserved field, and a variable-length Address field padded to a 32-bit boundary.