Subject: Should BFD respond even if there is no session?

From: Lokesh NB <[email-masked]>
Date: Thu, 4 Apr 2013 17:06:39 +0530

Hi All,
I'm trying to implement BFD tor monitor IPV4/IPv6 peers. I have a general
question.

If BFD receives a first session establishment packet from a peer but no
session matches what is the normal course of action in that case?. RFC 5880
says that you can either ignore the packet or create a new session. What is
the general handling of such a situation in the industry? do most of the
vendors respond to such a packet and create a BFD session? even though no
application in the system want to monitor peer that is requesting a
session?. Appreciate your help.

Thanks
-Lokesh.

---

From: Binny Jeshan <[email-masked]>
Date: Thu, 4 Apr 2013 17:20:41 +0530

Hello Lokesh,

I don't think i have come across such an implementation. In my experience,
such packets are ignored.

In MPLS, there is a mechanism known as Bootstrapping, through which BFD
Session establishes based on a Bootstrap ping request sent by the peer. For
more details refer
http://tools.ietf.org/html/rfc5884

Thanks,
Binny

---

From: "Nobo Akiya (nobo)" <[email-masked]>
Date: Thu, 4 Apr 2013 13:56:39 +0000

Hello Lokesh,

I agree with Binny. Best course of action is to ignore such packets at earliest ingress path, to avoid unnecessary resources taken up on the local node. Technically you could dynamically create a corresponding session based on incoming BFD packets, but it could become a vulnerability unless allowance is scoped and good amount of validations are performed. Even so, without any "action" attached to dynamically created BFD session on local node, it's basically doing a "favor" to requesting node. These complexity additions are avoided if both sides are required to be configured, thus drop such packets.

5884 creates session based on LSP echo request, so this one is a bit different.

Regards,
Nobo

From: [email-masked] [mailto:[email-masked]] On Behalf Of Binny Jeshan
Sent: Thursday, April 04, 2013 7:51 AM
To: Lokesh NB
Cc: [email-masked]
Subject: Re: Should BFD respond even if there is no session?

Hello Lokesh,

I don't think i have come across such an implementation. In my experience, such packets are ignored.

In MPLS, there is a mechanism known as Bootstrapping, through which BFD Session establishes based on a Bootstrap ping request sent by the peer. For more details refer
http://tools.ietf.org/html/rfc5884

Thanks,
Binny

On 4 April 2013 17:06, Lokesh NB <[email-masked]<mailto:[email-masked]>> wrote:
Hi All,
I'm trying to implement BFD tor monitor IPV4/IPv6 peers. I have a general question.

If BFD receives a first session establishment packet from a peer but no session matches what is the normal course of action in that case?. RFC 5880 says that you can either ignore the packet or create a new session. What is the general handling of such a situation in the industry? do most of the vendors respond to such a packet and create a BFD session? even though no application in the system want to monitor peer that is requesting a session?. Appreciate your help.
Thanks
-Lokesh.

---

From: Lokesh NB <[email-masked]>
Date: Fri, 5 Apr 2013 10:12:52 +0530

Thanks Nobo,
>From your response, it looks like generally BFD products do not honour such
packets and there is no interoperability problem if I do the same. Am I
right?
Is there any rare situation/application where you have do this favour to
requesting node?

Regards
-Lokesh.

On Thu, Apr 4, 2013 at 7:26 PM, Nobo Akiya (nobo) <[email-masked]> wrote:

>  Hello Lokesh,****
>
> ** **
>
> I agree with Binny. Best course of action is to ignore such packets at
> earliest ingress path, to avoid unnecessary resources taken up on the local
> node. Technically you could dynamically create a corresponding session
> based on incoming BFD packets, but it could become a vulnerability unless
> allowance is scoped and good amount of validations are performed. Even so,
> without any “action” attached to dynamically created BFD session on local
> node, it’s basically doing a “favor” to requesting node. These complexity
> additions are avoided if both sides are required to be configured, thus
> drop such packets.****
>
> ** **
>
> 5884 creates session based on LSP echo request, so this one is a bit
> different.****
>
> ** **
>
> Regards,****
>
> Nobo****
>
> ** **
>
> *From:* [email-masked] [mailto:[email-masked]] *On
> Behalf Of *Binny Jeshan
> *Sent:* Thursday, April 04, 2013 7:51 AM
> *To:* Lokesh NB
> *Cc:* [email-masked]
> *Subject:* Re: Should BFD respond even if there is no session?****
>
> ** **
>
> Hello Lokesh,****
>
> ** **
>
> such packets are ignored. ****
>
> ** **
>
> more details refer****
> http://tools.ietf.org/html/rfc5884****
>
> ** **
>
> Thanks,****
>
> Binny****
>
> ** **
>
> On 4 April 2013 17:06, Lokesh NB <[email-masked]> wrote:****
>
> Hi All,****
>
> session?. Appreciate your help. ****
>
> Thanks****
>
> -Lokesh.****
>
> ** **
>
> ** **
>

---

From: Binny Jeshan <[email-masked]>
Date: Fri, 5 Apr 2013 11:26:35 +0530

Hi Lokesh,

I think that should more depend on how your system is specified to work. In
case in the network you would need to do it that way as per what the
Operator wants AND if your device OEM agrees to do it, only then its
needed.

But if your equipment system engineering needs BFD session to start only
when your operator manually configures it, then you can stop honoring such
BFD packets whose session entry does not exist with you.

Regards,
Binny,
*Aricent Group.*

On 5 April 2013 10:12, Lokesh NB <[email-masked]> wrote:

> Thanks Nobo,
> From your response, it looks like generally BFD products do not honour
> such packets and there is no interoperability problem if I do the same. Am
> I right?
>> I don't think i have come across such an implementation. In my
>> experience, such packets are ignored. ****
>>
>> ** **
>>

---

From: "George Swallow (swallow)" <[email-masked]>
Date: Fri, 5 Apr 2013 14:54:17 +0000

It would most likely happen due to a misconfiguration where the operator has only configured one end of a desired (nor not deleted the other end of a no longer desired) BFD session.  The configured end will keep sending BFD packets to init but this should be 1 per second or less, and perhaps exponential back off is implemented, though this is not required (and barely mentioned) in the spec.

George

From: Lokesh NB <[email-masked]<mailto:[email-masked]>>
Date: Friday, April 5, 2013 12:42 AM
To: "Nobo Akiya (nobo)" <[email-masked]<mailto:[email-masked]>>
Cc: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: Should BFD respond even if there is no session?

Thanks Nobo,
>From your response, it looks like generally BFD products do not honour such packets and there is no interoperability problem if I do the same. Am I right?
Is there any rare situation/application where you have do this favour to requesting node?

Regards
-Lokesh.

On Thu, Apr 4, 2013 at 7:26 PM, Nobo Akiya (nobo) <[email-masked]<mailto:[email-masked]>> wrote:
Hello Lokesh,

I agree with Binny. Best course of action is to ignore such packets at earliest ingress path, to avoid unnecessary resources taken up on the local node. Technically you could dynamically create a corresponding session based on incoming BFD packets, but it could become a vulnerability unless allowance is scoped and good amount of validations are performed. Even so, without any “action” attached to dynamically created BFD session on local node, it’s basically doing a “favor” to requesting node. These complexity additions are avoided if both sides are required to be configured, thus drop such packets.

Regards,
Nobo

From:[email-masked]<mailto:[email-masked]> [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of Binny Jeshan
Sent: Thursday, April 04, 2013 7:51 AM
To: Lokesh NB
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: Should BFD respond even if there is no session?

Hello Lokesh,

Thanks,
Binny