Subject: few queries regarding BFD

From: Lokesh NB <[email-masked]>
Date: Fri, 3 May 2013 13:28:38 +0530

Hi All

I'm trying to design BFD for a router, I have couple of questions related
to capacity planning and want to know what is the general industry
deployment trend in those areas.  Any answers are greatly appreciated.

1. How to arrive at maximum number of BFD sessions to be supported in a
high end router.?

2. what is the currently supported maximum number of BFD sessions in high
end routers? is it in the orders of hundreds of thousands?

3. What is the minimum Tx time to be supported for layer 3 UDP encap peers?
I know cisco supports minimum 50 msec but can we expect requirement for IP
peers to be monitored below that 50 msecs? like 10,20 msec?

4. What is average Tx time usually IP peers settle for in general? is it
like 100-300 msec? In other words what is usually configured Tx time for IP
peers?

5. What is the expected percentage of BFD traffic of the total bandwidth of
the device? I know it depends on how many sessions are active in parallel
and Tx/Rx timers but in general is it correct to estimate that BFD traffic
generally should not exceed 2 to 5 % of the total bandwidth available for
user data?

6. How frequently Auth is used in general deployments? is it only used for
multi hop peers usually?

Regards
-Lokesh

---

From: Binny Jeshan <[email-masked]>
Date: Fri, 3 May 2013 14:07:43 +0530

Hi Lokesh,

My views on this:

1. This depends on how many paths you need to monitor and number of
probable combinations with which you need to monitor one path. This depends
on your system and deployment requirement majorly.

2. Could run few thousands.

3. if 50 ms is the total switchover requirement, you atleast need to have
5ms Tx timer + Detect multiplier 2 = to confine within 10ms detection time
of the total available 50 ms. That again depends on your system performance
on swithover. Again it totally depends on operators need.

4. Nowhere you will be able to get this accurate stats.

5. This is your system requirement. You will need to define it. Just make
sure that congestion requirements are met.

6. Cannot comment anything solid again. Auth is used if you need to hide
your information. You may not get exact answers in this forum :(

Thanks,
Binny Jeshan.

On 3 May 2013 13:28, Lokesh NB <[email-masked]> wrote:

> 3. What is the minimum Tx time to be supported for layer 3 UDP encap
> peers? I know cisco supports minimum 50 msec but can we expect requirement
> for IP peers to be monitored below that 50 msecs? like 10,20 msec?
>
> 5. What is the expected percentage of BFD traffic of the total bandwidth
> of the device? I know it depends on how many sessions are active in
> parallel and Tx/Rx timers but in general is it correct to estimate that BFD
> traffic generally should not exceed 2 to 5 % of the total bandwidth
> available for user data?
>

---

From: Lokesh NB <[email-masked]>
Date: Fri, 3 May 2013 15:05:22 +0530

Thanks binny for answers,
yes, I know these are system requirements. I want to plan my system
requirements in line with general industry acceptable numbers. As I'm new
to this area I have very little idea on what are the new trends in the BFD
capacity setting in high end routers. Do you know any link or discussion on
these things on internet or elsewhere?
Regards
-Lokesh

On Fri, May 3, 2013 at 2:07 PM, Binny Jeshan <[email-masked]> wrote:

>> 6. How frequently Auth is used in general deployments? is it only used
>> for multi hop peers usually?
>>
>> Regards
>> -Lokesh
>>
>>
>>
>>
>>
>>
>>
>

---

From: Marc Binderberger <[email-masked]>
Date: Fri, 3 May 2013 12:00:33 +0200

Hello Lokesh,

some questions are quite generic but nevertheless ...

> 1. How to arrive at maximum number of BFD sessions to be supported in a high end router.?

distributed architecture and/or using ASIC/FPGA/NP to offload the packet Tx/Rx

> 2. what is the currently supported maximum number of BFD sessions in high end routers? is it in the orders of hundreds of thousands? 

Thousands. Details may depend on the timer values when the implementation is software based, still system-wide I stick to "thousands".

> 3. What is the minimum Tx time to be supported for layer 3 UDP encap peers? I know cisco supports minimum 50 msec but can we expect requirement for IP peers to be monitored below that 50 msecs? like 10,20 msec?

Actually this particular vendor you mention supports 15msec for high-end equipment today. With a multiplier of 2 that makes a detection time of 30msec maximum, so depending on the fiber length in a network that could make the 50-60msec time for detection & restoration.

Obviously: the faster the timer the better :-) , for MPLS-TP OAM the usual number you hear is 3.3msec (so 10msec detection time with a multiplier of 3).

> 4. What is average Tx time usually IP peers settle for in general? is it like 100-300 msec? In other words what is usually configured Tx time for IP peers?

there is no single number, too many network designs out there in real life. In the core customers typically go fast, to the endpoints some customers go slower, just to stay below 1sec detection time so VoIP controller don't freak out. 

Regards, Marc

> 5. What is the expected percentage of BFD traffic of the total bandwidth of the device? I know it depends on how many sessions are active in parallel and Tx/Rx timers but in general is it correct to estimate that BFD traffic generally should not exceed 2 to 5 % of the total bandwidth available for user data?
> 
> 6. How frequently Auth is used in general deployments? is it only used for multi hop peers usually? 
> 
> Regards
> -Lokesh
> 
> 
> 
> 
> 
>

---

From: Binny Jeshan <[email-masked]>
Date: Fri, 3 May 2013 15:53:13 +0530

Hello Lokesh,

For the Authenication part, i would suggest please go ahead and provide
that functionality. Its optional anyways to use it in reality.

Regards,
Binny

On 3 May 2013 15:30, Marc Binderberger <[email-masked]> wrote:

> > 2. what is the currently supported maximum number of BFD sessions in
> high end routers? is it in the orders of hundreds of thousands?
>
> Thousands. Details may depend on the timer values when the implementation
> is software based, still system-wide I stick to "thousands".
>
>
> Actually this particular vendor you mention supports 15msec for high-end
> equipment today. With a multiplier of 2 that makes a detection time of
> 30msec maximum, so depending on the fiber length in a network that could
> make the 50-60msec time for detection & restoration.
>
> Obviously: the faster the timer the better :-) , for MPLS-TP OAM the usual
> number you hear is 3.3msec (so 10msec detection time with a multiplier of
> 3).
>
>
> there is no single number, too many network designs out there in real
> life. In the core customers typically go fast, to the endpoints some
> customers go slower, just to stay below 1sec detection time so VoIP
> controller don't freak out.
>
>
> Regards, Marc
>
>
>

---

From: Kristian Larsson <[email-masked]>
Date: Fri, 03 May 2013 13:44:45 +0200

On 05/03/2013 09:58 AM, Lokesh NB wrote:
> Hi All
>
> I'm trying to design BFD for a router, I have couple of questions
> related to capacity planning and want to know what is the general
> industry deployment trend in those areas.  Any answers are greatly
> appreciated.
>
Depends on number of ports. For a core router you typically need one
very high frequency BFD per port while for a edge router with thousands
of customers you will need as many BFD sessions as you have customer
ports but perhaps at a somewhat lower rate.

> high end routers? is it in the orders of hundreds of thousands?
Most high end routers distribute the BFD processing to the linecards.
The ASR9k for example support ~6.7kPPS per linecard CPU - see
http://www9.cisco.com/en/US/docs/routers/asr9000/software/asr9k_r3.9/interfaces/configuration/guide/hc39bifw.html

> peers? I know cisco supports minimum 50 msec but can we expect
> requirement for IP peers to be monitored below that 50 msecs? like
> 10,20 msec?

Cisco supports 15ms on IOS XR and I think it is reasonable to support
something like 10ms (keepalive) to achieve failure detection in 30ms and
able to converge in 50ms.

>
> 4. What is average Tx time usually IP peers settle for in general? is
> it like 100-300 msec? In other words what is usually configured Tx
> time for IP peers?
I know of one rather large European IP network that does 3x15ms on core
links and prefer 3x50ms on eBGP sessions.

>
> 5. What is the expected percentage of BFD traffic of the total
> bandwidth of the device? I know it depends on how many sessions are
> active in parallel and Tx/Rx timers but in general is it correct to
> estimate that BFD traffic generally should not exceed 2 to 5 % of the
> total bandwidth available for user data?

Insignificant on 10G links.

> for multi hop peers usually?
No idea.

Kind regards,
    Kristian.

---

From: Lokesh NB <[email-masked]>
Date: Mon, 6 May 2013 14:58:33 +0530

Kristian, Marc, Binny
Thank you all  !
Greatly appreciate your help !

Regards
-Lokesh.

---

From: Glen Kent <[email-masked]>
Date: Mon, 13 May 2013 00:22:00 +0530

Authentication is never used to hide information in the routing protocols.

Its always used to authenticate the sender of the protocol packet. Usually,
its configured only to detect misconfigured peers. Since BFD is a fast
protocol and is often implemented in HW, getting authentication to work is
complex. This i believe is the primary reason why the authentication
related drafts in BFD WG have still not progressed.

> your information. You may not get exact answers in this forum :(
Glen

---

From: Jeffrey Haas <[email-masked]>
Date: Sun, 12 May 2013 14:59:54 -0400

On Mon, May 13, 2013 at 12:22:00AM +0530, Glen Kent wrote:
> its configured only to detect misconfigured peers.

This is certainly a common operational benefit from authentication - and
often one that drives the lowest common denominator on protocols.

But that said, it's also there to protect against active attacks on the
protocol by "bad guys".  How strong you protect your protocol depends on who
you're trying to protect yourself against and how critical your protocol is.

Given the nature of BFD, an active attack would likely either try to:
- Keep the protocol up when it's really down.
- Keep the protocol down when it should come up.

Feel free to construct your own attack trees against the business cases of
BFD deployment given the above. :-)

> Since BFD is a fast

Minimally, better crypto eats more CPU.  In some cases, you can get hardware
assist on that crypto and thus not take a penalty against a more general
purpose CPU that is supposed to be doing other forwarding critical things.

The question that must be asked as a protocol developer or implementor is
"what is the benefit and against what am I protecting my protocol".  This
will usually lead to the appropriate business case.

-- Jeff (all, IMO)

---

From: Lokesh NB <[email-masked]>
Date: Fri, 17 May 2013 10:00:22 +0530

Thanks Marc for the answers,

>Thousands. Details may depend on the timer values when the implementation
is software based, still >system-wide I stick to "thousands".

do you have any information about what is the highest number of BFD
sessions supported by high end routers? I mean how many thousands of
sessions do they support? I searched online but could not find the info.

Regards
-Lokesh

---

From: Marc Binderberger <[email-masked]>
Date: Fri, 17 May 2013 09:41:16 +0200

Hello Lokesh,

I know about systems that support 8k - 16k BFD sessions per linecard and "no limit" per system. For software-based I/O we talk about intervals of several hundreds of milliseconds then, hardware-based I/O can deliver much faster though.

I use quotation marks as it mainly means no hard limits in the code; in reality one may find certain code/data structures like SNMP work fine for a few thousands but not for hundreds of thousands of sessions - and need optimization.

Regards, Marc

On 2013-05-17, at 6:30 , Lokesh NB wrote:

> >Thousands. Details may depend on the timer values when the implementation is software based, still >system-wide I stick to "thousands".
> 
> do you have any information about what is the highest number of BFD sessions supported by high end routers? I mean how many thousands of sessions do they support? I searched online but could not find the info.
> 
> Regards
> -Lokesh
> 
> 
> 
>