IP SLA, TWAMP and Ethernet CFM / Y.1731

Theoretical foundations and architecture

LSP checks and BFD answer the question "is the path alive", but a service contract promises numbers: delay, jitter and loss. They are measured actively: synthetic probe packets are sent across the network periodically and the metrics are computed from the replies. The lesson covers three families of tools. IP SLA, NQA and RPM are proprietary probes on the router (ICMP, UDP jitter) with thresholds and reactions. TWAMP (RFC 5357) is a standard two-way measurement protocol with a TCP 862 control channel and a UDP test stream that different vendors understand. Ethernet CFM (IEEE 802.1ag) and Y.1731 work at layer 2: maintenance domains, MEPs and MIPs, Continuity Check, loopback and linktrace, while Y.1731 adds delay and loss measurement. It also covers how to bind measurements to L2VPN services and how to set thresholds and alarms so as not to get false alerts. It assumes the knowledge of LSP OAM, BFD and L2VPN from the earlier lessons.

Active and passive measurement

Passive data (interface counters, IPFIX) shows what the network sees but does not give a guaranteed picture for a particular path: no traffic - no data. Active measurement sends synthetic packets of a known size, interval and DSCP marking and computes the delay, jitter and loss of the chosen path and class from the replies. It is the basis of SLA verification and acceptance (see the network acceptance lesson). A probe takes bandwidth and CPU, so the rate is chosen to give statistics without overload: 100 packets once per 60 seconds is only about 1.7 packets per second per probe. The result always depends on the path: a probe follows the same route as customer traffic only if the QoS class and the ECMP hash match (vary the source ports), otherwise a different path is measured.

IP SLA, NQA and RPM

Cisco IP SLA, Huawei NQA and Juniper RPM are probes on the router itself. Typical operations: ICMP echo (RTT and loss), UDP echo, UDP jitter. UDP jitter on Cisco uses a responder on the remote side (ip sla responder): on send and receive the responder records four timestamps, from which the delay in each direction, the jitter and the loss in both directions are computed; one-way delay can be trusted only with synchronized clocks. Parameters: the packet count, the interval between them (20 ms imitates voice), the run frequency, the timeout and the threshold. Reactions turn a threshold violation into an SNMP trap or syslog, and a track object binds the probe to a static route or redundancy: the route is removed when the probe to the next hop stops answering. Limitations: most platforms process probes on the CPU, the timestamps are set in software, so on a busy device the measurement contains its own noise and is unsuitable for millisecond accuracy; some platforms have hardware timers.

TWAMP (RFC 5357)

The Two-Way Active Measurement Protocol standardizes a two-way test between vendors. Roles: the control-client and server (control) and the session-sender and session-reflector (test). The control protocol runs over TCP, port 862: the server sends a Server Greeting with the supported modes (unauthenticated, authenticated, encrypted) and a challenge, the client answers with Set-Up-Response, the server with Server-Start; then the client sends Request-TW-Session with ports, size and timeout, the server answers Accept-Session and Start-Sessions starts the test; Stop-Sessions ends it. The test protocol is UDP: the sender packet carries a sequence number, a 64-bit timestamp in NTP format, an error estimate (the S bit shows clock synchronization and a multiplier) and padding up to the required size; the reflector adds the receive timestamp, the send timestamp, its own sequence number and a copy of the sender data. TWAMP-Light (an appendix of RFC 5357) does without the control protocol: both ends are configured manually and the reflector simply returns packets, so it is supported more often. The successor is STAMP (RFC 8762), a simplified protocol with the same packet format in the spirit of TWAMP-Light. The metrics are defined in RFC 2679 (one-way delay), RFC 2680 (loss), RFC 3393 (delay variation, IPDV) and RFC 5481 (comparison of approaches). Use percentiles (p95, p99) and not only the mean for statistics: the mean hides bursts.

Ethernet CFM (IEEE 802.1ag)

CFM (Connectivity Fault Management) is layer 2 OAM for an Ethernet service. A service is described by a hierarchy: a Maintenance Domain (MD) with a level 0-7, inside it a Maintenance Association (MA) identified by the domain name and a short string (MAID); a Maintenance End Point (MEP, ID 1-8191) sits at the boundary of the MA and generates or receives OAM frames, a Maintenance Intermediate Point (MIP) answers loopback and linktrace but does not send CCMs itself. The levels divide responsibility: usually 5-7 are the customer, 3-4 the provider (end to end between UNIs), 0-2 the operator or network segments. OAM frames carry EtherType 0x8902 and a multicast destination address that depends on the level; OAM frames of a level above a MEP pass transparently, those below are dropped, so levels do not intersect. MEPs are Up (facing the bridge, into the device) or Down (facing the port, toward the line).

The Continuity Check Message (CCM, opcode 1) is a periodic multicast frame: intervals are coded as 1-7 (3.33 ms, 10 ms, 100 ms, 1 s, 10 s, 1 min, 10 min). A MEP considers a remote MEP lost if no CCM arrives within 3.5 intervals; the defects are: Remote CCM (no CCM from the peer), Error CCM (an unknown MEP ID, a wrong interval or level), Xcon CCM (a foreign MA in our MD: a service cross-connect error) and RDI (a bit in the CCM that tells the remote side is not receiving). Loopback (LBM opcode 3 / LBR opcode 2) is the layer 2 analogue of ping, addressed by unicast to the MAC of a MEP/MIP. Linktrace (LTM 5 / LTR 4) is sent with a TTL to a multicast address and shows the path: every MIP returns an LTR and forwards the LTM on, which finds the break in the bridge path.

Y.1731

ITU-T Recommendation Y.1731 extends CFM with performance functions. Delay Measurement: 1DM (opcode 45, one-way, needs clock synchronization) and DMM/DMR (47/46, two-way, no synchronization needed for RTT). Loss Measurement: LMM/LMR (43/42) use frame counters on the MEP and compute loss separately in two directions, while Synthetic Loss Measurement (SLM) uses synthetic frames, which is cheaper and suits cases where there are no service counters. Other functions: AIS (opcode 33, an alarm signal up the levels), LCK (35, a lock during maintenance), TST (37, a test), APS and MCC. DMM/LMM frames are created in hardware on many platforms, so the accuracy is higher than for the software probes of IP SLA; the one-way delay of 1DM should be combined with PTP.