Test Protocol for One-way IP Capacity Measurement

The IETF's efforts to define Network and Bulk Transport Capacity have been chartered and finally progressed after over twenty years. In that time, the performance community has seen development of Informative definitions in for Framework for Bulk Transport Capacity (BTC), RFC 5136 for Network Capacity and Maximum IP-layer Capacity, and the Experimental metric definitions and methods in , Model-Based Metrics for BTC. This memo looks at the problem of measuring Network Capacity metrics defined in where the method deploys a feedback channel from the receiver to control the sender's transmission rate in near-real-time. Although there are several test protocols already available for support and management of active measurements, this protocol is a major departure from their operation: UDP transport, not TCP, is used for Control phase messages (e.g., Test Setup, Test Activation) and Data phase messages (e.g., Load, Status Feedback). TWAMP and STAMP use the philosophy that one host is a Session-Reflector, sending test packets every time they receive a test packet. This protocol supports a one-way test with periodic status messages returned to the sender. These messages are also a basis for on-path Round-trip delay measurements, which are a key input to the load adjustment search algorithm. OWAMP supports one-way testing with results Fetch at the end of the test session. This protocol supports a one-way test and requires periodic status messages returned to the sender to support the load adjustment search algorithm. The security features of OWAMP and TWAMP have been described as "unusual", to the point that IESG approved their use while also asking that these methods not be used again. Further, the common OWAMP and TWAMP approach to security is over 15 years old at this time. Note: the -00 update of this draft will be the last that describes version 8 of the protocol in the running code. Updates -01 and -02 of the draft correspond to version 9 of the protocol, which strives to allow interoperability with version 8. The -03 and -04 updates of the draft incorporate new security modes of operation, and correspond to version 10 of the protocol. Ruediger Geib joined the team of authors to help completing this draft. He's not replacing Al Morton, as Al can't be replaced.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

The scope of this memo is to define a protocol to measure the Maximum IP-Layer Capacity metric and according to the standardized method. We note that aspects of this protocol and end-host configuration can lead to support of additional forms of measurement, such as application emulation enabled by creative use of the Load Adjustment algorithm. The continued goal is to harmonize the specified IP-Layer Capacity metric and method across the industry, and this protocol supports the specifications of IETF and other Standards Development Organizations. All active testing protocols currently defined by the IPPM WG are UDP-based, but this protocol specifies both control and test protocols using UDP transport. Also, a feedback message stream continues operating during testing to convey results and dynamic configurations. The primary application of the protocol described here is the same as in Section 2 of where: The access portion of the network is the focus of this problem statement. The user typically subscribes to a service with bidirectional access partly described by rates in bits per second.

This section gives an informative overview of the communication protocol between two test end-points (without expressing requirements or describing the authentication and encryption aspects; later sections provide these details and requirements). One end-point takes the role of server, listening for connection requests on a well-known destination port from the other end-point, the client. The client requires configuration of a test direction parameter (upstream or downstream test, where the client performs the role of sender or receiver, respectively) as well as the hostname or IP address of the server in order to begin the setup and configuration exchanges with the server. The protocol uses UDP transport and has four types of exchanges in two phases. Exchanges 1 and 2 constitute the Control phase, while exchanges 3 and 4 constitute the Data phase. Setup Request and Response Exchange: The client requests to begin a test by communicating its protocol version, intended security mode, and jumbo datagram support. The server either confirms matching configuration or rejects the connection. The server also communicates the ephemeral port for further communication when accepting the client's request. Test Activation Request and Response: the client composes a request conveying parameters such as the testing direction, the duration of the test interval and test sub-intervals, and various thresholds. The server then chooses to accept, ignore or modify any of the test parameters, and communicates the set that will be used unless the client rejects the modifications. Note that the client assumes that the Test Activation exchange has opened any co-located firewalls and network address/port translators for the test connection (in response to the Request packet on the ephemeral port) and the traffic that follows. If the Test Activation Request is rejected or fails, the client assumes that the firewall will close the address/port combination after the firewall's configured idle traffic time-out. Test Stream Transmission and Measurement Feedback Messages: Testing proceeds with one end-point sending load PDUs and the other end-point receiving the load PDUs and sending frequent status messages to communicate status and transmission conditions there. The feedback messages are input to a load-control algorithm at the server, which controls future sending rates at either end-point as needed. The choice to locate the load-control algorithm at the server, regardless of transmission direction, means that the algorithm can be updated more easily at a host within the network, and at a fewer number of hosts than the number of clients. Stopping the Test: When the specified test duration has been reached, the server initiates the exchange to stop the test by setting the STOP1 indication in load PDUs or status feedback messages. The client acknowledges by setting the STOP2 in further load PDUs or messages, and a graceful connection termination at each end-point follows. (Since the load PDUs and feedback messages are used, this exchange is kind of a sub-exchange of 3.) If the Test traffic stops or the communication path fails, the client assumes that the firewall will close the address/port combination after the firewall's configured idle traffic time-out. Both the client and server react to unexpected interruptions in the Control phase or test traffic. Watchdog timers limit the time a server or client will wait before stopping all traffic and terminating a test.

For Parameters related to the Maximum IP-Layer Capacity Metric and Method, please see Section 4 of .

There are four security modes of operation: A REQUIRED mode with authentication during the Control phase: Test Setup and Test Activation exchanges. An OPTIONAL mode with additional authentication during the Data phase: applicable only to the Status Feedback messages. An OPTIONAL unauthenticated mode for all messages. An OPTIONAL mode with encryption of the Control phase exchanges and the Status Feedback messages. For full encryption, OPTIONAL operation of both Control and Data phase exchanges inside an encrypted tunnel chosen and instantiated via a bilateral agreement between the users. The requirements below refer to the PDUs in the sections that follow, primarily the authUnixTime field and the authDigest field. The roles in this section have been generalized so that the requirements for the PDU sender and receiver can be re-used and referred to elsewhere.

In the OPTIONAL unauthenticated mode, all PDU senders SHALL set the authUnixTime field and the authDigest field of all packets to all zeroes. Any errors (configuration miss-match between client and server) found in the Test Setup exchange or the Test Activation exchange SHOULD result in silent rejection (no further packets sent on the address/port pairs). The exception is when the testing hosts have been configured for trouble-shooting Control phase failures and rejection messages will aid in the process.

In the REQUIRED authentication mode, the client and the server SHALL be configured to use one of a number of shared secret keys. During the Control phase, the sender SHALL read the current time and populate the authUnixTime field, then calculate the authDigest field of the request packet (with the authDigest field set to all zeroes) according to and send the packet to the receiver. Upon reception, the receiver SHALL validate the message PDU for validity of the authDigest, the authUnixTime field for acceptable immediacy, correct length, and formatting (PDU-specific fields are also checked, such as protocol version). If the validation fails, the receiver SHOULD NOT continue with the Control phase and implement silent rejection (no further packets sent on the address/port pairs). The exception is when the testing hosts have been configured for trouble-shooting Control phase failures and rejection messages will aid in the process. If the validation succeeds, the receiver SHALL continue with the Control phase and compose a successful response or a response indicating the error conditions identified. This process SHALL be executed for each request and response in the Test Setup exchange (Section 5) and the Test Activation exchange (Section 6), amounting to four packets exchanged (plus any "dummy" packets needed).

When using the OPTIONAL authentication during the Data Phase, the process SHALL be applied to the Status PDU only. The client sends the Status PDU in a downstream test, and the server sends in an upstream test. The Status PDU sender reads the current time and populates the authUnixTime field, then calculates the authDigest field of the entire Status PDU (see Section 7.2). The Authentication Fields appear at the end of the Status PDU. Upon reception of a Status PDU in mode 2, the receiver SHALL validate the message PDU for validity of the authDigest, the authUnixTime field for acceptable immediacy, correct length, and formatting (PDU-specific fields are also checked, such as protocol version). If the authentication validation fails, the receiver SHALL ignore the message. If the watchdog timer expires (due to successive failed validations, the test session will prematurely terminate (no further load traffic SHALL be transmitted). If this optional mode has not been selected, then the authUnixTime field and the authDigest field of the Status PDU (see Section 7.2) SHALL be populated with all zeroes.

This mode is mutually exclusive with the Authenticated modes (1 and 2). The encryption algorithm specified includes integrity protection. This mode re-uses several protocol fields beginning with "auth", which is reasonable since both authentication and encryption are provided (the field format is presented in later sections). When using the OPTIONAL Partial Encryption, the process SHALL be applied to the Test Setup Request, the Test Setup Response, the Test Activation Request, the Test Activation Response, and the Status PDU. The client sends the Status PDU in a downstream test, and the server sends it in an upstream test. In the OPTIONAL Partial encryption mode, the client and the server SHALL be configured to use one of a number of shared secret keys (see keyID). The following encryption specifications SHALL be used: Advanced Encryption Standard, AES, according to Federal Information Processing Standards Publication 197 . Galois/Counter Mode (GCM) Key size of 256 bits (fixed block size of 128 bits) The sender (intending to use encryption) SHALL read the current time and populate the authUnixTime field of the request packet. Then, the sender SHALL encrypt the header up to but not including the Initialization Vector (IV) field. The IV SHALL be stored in the IV field as-is, with any unused bits as MBZ, and communicated in the clear. Finally, the sender SHALL send the packet with encrypted PDU to the receiver. Upon reception, the receiver SHALL decrypt the PDU using the included IV and shared key, and then validate the correct header length, ID, and protocol version. Next, check the authUnixTime field for acceptable immediacy, and testSessionID for uniqueness. Finally, the PDU-specific fields that control the test are processed. If the PDU validation fails in the Control phase, the receiver SHOULD NOT continue with current exchange and implement silent rejection (no further packets sent on the address/port pairs). The exception is when the testing hosts have been configured for trouble-shooting Control phase failures and rejection messages will aid in the process. If the validation succeeds in the Control phase, the receiver SHALL continue with the current exchange and compose a successful response or a response indicating the error conditions identified. The response PDU SHALL be encrypted as described above, and the packet with encrypted PDU SHALL be sent back to the originator. This process SHALL be executed for each request and response in the Test Setup exchange (Section 5) and the Test Activation exchange (Section 6), amounting to four packets exchanged (plus any "dummy" packets needed). The Status Feedback Message header PDU SHALL also be encrypted by the sender, (with authUnixTime populated and the IV plus MBZ remainder in the authDigest field) and subjected to header field validations at the receiver after the decryption process. If the PDU validation fails for a Status PDU, the receiver SHALL ignore the message. If the watchdog timer expires (due to successive failed validations, the test session will prematurely terminate (no further load traffic SHALL be transmitted).

Two users may wish to make private measurements as part of a bilateral agreement, and they might achieve this goal by encrypting the traffic of this protocol. However, there is no advantage in a native-protocol mode to encrypt all traffic when industry solutions for encrypted tunnels are widespread and users can deploy the tunnel technology of their choice ( for IPsec and for TLS). Although it was suggested, DTLS could not be the basis for a mode with encryption of the all PDUs. The replay protection would remove duplicated packets and prevent transparent measurement of this impairment. The protocol's operation is mostly independent from the tunnel operation, but reject messages during the Control phase MAY be sent, the same as when configuring the server for troubleshooting. Also, the additional encapsulation header size will likely limit the maximum UDP payload possible in the Full Encryption mode, and users may need to account for the smaller limit. Operation of both Control and Data phases inside an encrypted tunnel would provide a measure of privacy for all protocol operations, but the cost could be inaccurate measurements (from the additional processing overhead on Load PDUs at Gigabit rates) and reduced scale (when considering a server's capacity to host test sessions). The primary scope of this protocol is Internet access measurement. This scope greatly limits the geography of the eavesdropping attack surface, and encourages user-selected encryption solutions when needed (although this need may be more likely when the protocol is used beyond its intended scope). IPPM protocols that have been deployed in this scope have not used the encryption option, and at least one of these protocols [TWAMP] has been deployed at great scale without using the encrypted mode. The key pieces of information exposed by the protocol are found in the feedback status messages which are transferred every 50ms with default timing. The feedback status messages contain either detailed measurements of the previous status interval in a downstream test, or the next sending rate for the sender in an upstream test. If the feedback status messages are encrypted and de-crypted, then the processing time may affect the Round-Trip-Time measurements and affect the protocol operation, especially the load adjustment search algorithm. Thus, the processing time is a key concern for low cost CPE (e.g., residential gateways hosting the client function). The test configuration information exchanged elsewhere is considered mundane. The tunnel approach has some advantages. Some users may want to characterize the encrypted tunnel in comparison to transport in the clear. It is RECOMMENDED to use the Unauthenticated mode to maximize server and client performance for the clear transport case, but some may wish to use the Authenticated mode (1). Users can also leave the encrypted tunnel up when conducting repeating tests, and reduce test setup time to the minimum.

Section 2 of specifies a conceptual database for long-lived cryptographic keys. The database is implemented as a plaintext table, to allow text editor maintenance of the key table. The key table SHALL be used with the REQUIRED authentication mode and the OPTIONAL authentication mode (using the same key). The same key table SHALL be used with the OPTIONAL Partial Encryption mode, when used. The Key table SHALL have (at least) the following fields, referring to Section 2 of : AdminKeyName LocalKeyName AlgID Key SendLifetimeStart SendLifetimeEnd AcceptLifetimeStart AcceptLifetimeEnd The LocalKeyName SHALL be determined from the corresponding protocol field in the PDUs that follow, KeyID.

Normal firewall configuration allows a host to open a bidirectional connection using unique source and destination addresses and port numbers by sending a packet using that set of 4-tuple values. The client's interaction with its firewall depends on this configuration. The firewall at the server MUST be configured with an open pinhole for the server IP address and well-known UDP port of the server. Assuming that the firewall administration at the server does not allow an open UDP ephemeral port range, then the server MUST send a dummy packet to the client with the ephemeral port selected by the server and communicated to the client in the Test Setup Response. The dummy packet may not reach the client: it may be discarded by the client's firewall. If the server firewall administration allows an open UDP ephemeral port range, then the dummy packet operation is not strictly necessary. However, the availability of an open port range policy cannot be assumed.

All messages defined in this section SHALL use UDP transport. The hosts SHALL calculate and include the UDP checksum, or check the UDP checksum as necessary.

The client SHALL begin the Control phase exchanges by sending a Test Setup Request message to the server's control (well-known) port. The client SHALL simultaneously start a test initiation timer so that if the Control phase fails to complete Test Setup and Test Activation exchanges in the allocated time, the client software SHALL exit (close the UDP socket and indicate an error message to the user). Lost messages SHALL NOT be retransmitted. The test initiation timer uses the watchdog timeout (for a no-traffic warning) and a longer test termination timeout. Note: In version 9 and 10, the watchdog timeout is configured as a 1 second interval to trigger a warning message that the received traffic has stopped. The test termination timeout is based on the watchdog interval, and implements a wait time of 2 additional seconds before triggering a non-graceful termination. The Setup Request message PDU SHALL be organized as follows:

Figure 1 Test Setup PDU with Request fields populated, others explained below The UDP PDU format layout SHALL be as follows (big-endian AB):

Figure 2 Test Setup Message PDU Format maxBandwith: when this field is non-zero, it is a specification of the maximum bit rate the client expects to send or receive during the requested test. The server compares this value to a configured limit. modifierBitmap: There are two bits currently assigned in this bitmap: Do not use Jumbo Frames above sending rates of 1Gbps Use Traditional MTU (1500 bytes with IP-header) Other bit positions are currently undefined. A new registry will be needed for modifierBitmap assignments; see the IANA Considerations Section. testSessionId: This is a pseudo-random number used with authentication or encryption. The client SHALL select an identifier (ID) for the test session which is unlikely to match values used by other clients or previous sessions of the local client (e.g., the software's process ID or ephemeral source port number). Note: it is even more unlikely to have collisions between two clients that accidentaly choose the same testSessionID if the authUnixTime is also stored with the testSessionID as a pair. keyId: This is a localKeyName, the numeric key identifier for a key in the shared Key table. authMode: The authMode field currently has four values assigned: OPTIONAL unauthenticated mode REQUIRED authentication for Control phase OPTIONAL authentication for Data phase, in the Status Feedback PDU (added to Mode 1 requirements) OPTIONAL partial encrypted mode plus, a range of values for experimentation: 60 through 63. A new registry will be needed for mode values; see the IANA Considerations Section. authDigest or Initialization Vector field: In Authenticated mode, this field contains the authDigest from the SHA-256 function. In Partial Encrypted mode, this field begins with the Initialization Vector (IV) bits and the remaining (unused) bits are MBZ.

When operating in either of the authenticated modes (authMode 1 and authMode 2), the client SHALL follow the requirements of Section 4.2.2 (and 4.2.3 if applicable), and SHALL generate the authDigest field. The SHA-256 calculation SHALL cover the 12 preceding fields. The current Unix time SHALL be read and inserted immediately prior to the calculation (as immediately as possible). Computation of authDigest SHA-256 is specified in .

When operating in Unauthenticated mode (authMode 0), the requirements of Section 4.2.1 SHALL be followed.

When operating in the partial encryption mode, the client SHALL follow the requirements of Section 4.2.4 and SHALL encrypt the Test Setup Request PDU through the authUnixTime field, but no further. The current Unix time SHALL be read and inserted immediately prior to the encryption processing (as immediately as possible).

This Section describes the processes at the server to evaluate the Test Setup Request and determine the next steps.

When the server receives the Setup Request, it SHALL: process/validate the request message by checking the authDigest if operating in one of the Authenticated modes as prescribed in Section 4.2.2, or validate and decrypt the request message using the method prescribed in Section 4.2.4 if operating in the Partial Encryption mode, and then proceed to evaluate the other fields in the protocol header, such as the protocol version, the controlID (to validate the type of message, Setup), the maximum Bandwidth requested for the test, and the modifierBitmap for use of options such as Jumbo datagram status and traditional MTU (1500 bytes). The value in the authUnixTime field is a 32-bit time stamp and a 5 minute tolerance window (+/- 2.5 minutes) SHALL be used (if in one of the Authenticated modes) to distinguish a subsequent replay of a Test Setup Request. Replay of most other fields would remain valid if there was no authUnixTime field in the PDU, although the testSessionId MUST be unique as well. The authUnixTime is covered by the authDigest hash, as specified earlier. If the client has selected options for: Jumbo datagram support status (modifierBitmap), Traditional MTU (modifierBitmap), Authentication mode (authMode) that do not match the server configuration, the server MUST reject the Setup Request. If the Setup Request must be rejected (due to the reasons in the Command Response, CRSP, codes listed below), the conditions below determine whether the server sends a response: In Authenticated modes, if the authDigest is valid, a Test Setup Response SHALL be sent back to the client with a corresponding command response value indicating the reason for the rejection. The server SHALL follow the requirements of Section 4.2.2 and insert the autDigest in the response. In Authenticated modes, if the authDigest is invalid, then the Test Setup Request SHOULD fail silently. The exception is for operations support: server administrators using Authentication are permitted to send a Setup Response to support operations and troubleshooting. If unauthenticated mode is selected, the Test Setup Request SHALL fail silently. If Partial Encrypted mode is used, only valid Test Setup Request packets will be decrypted for server processing and a Test Setup Response is REQUIRED. The server SHALL follow the requirements of Section 4.2.4 to encrypt the response. If Full Encrypted mode is used, only valid Setup request packets will be forwarded up the stack for server processing and a Test Setup Response is possible if the server is configured to send responses for troubleshooting. The additional, non-authentication and non-encryption-related circumstances when a server SHALL not communicate the appropriate Command Response Code for an error condition (fail silently) are when: the Setup Request PDU size is not correct, the control ID is invalid, or a directed attack has been detected, in which case the server will allow setup attempts to terminate silently. Attack detection is beyond the scope of this specification. When the server replies to the Test Setup Request message, the PDU SHALL be organized as follows:

uint16_t maxBandwidth;// Required bandwidth uint16_t testPort; // Test port on server(available port in Resp) uint8_t modifierBitmap;// Modifier bitmap (see table below) uint8_t authMode; // Authentication mode uint16_t testSessionId; // client-selected pseudo-random number for the test session uint8_t keyId; // localKeyName, an index to the shared Key table uint8_t reserved; // reserved octet uint32_t authUnixTime;// Authentication time stamp unsigned char authDigest[AUTH_DIGEST_LENGTH] //32 octets, also IV cmdResponse Code Field: Command Server Response Codes (CSRP) (decimal) CHSR_CRSP_NONE 0 = None (value used by client in Request) CHSR_CRSP_ACKOK 1 = Acknowledgement CHSR_CRSP_BADVER 2 = Bad Protocol Version CHSR_CRSP_BADJS 3 = Invalid Jumbo datagram option CHSR_CRSP_AUTHNC 4 = Unexpected Authentication in Setup Request CHSR_CRSP_AUTHREQ 5 = Authentication missing in Setup Request CHSR_CRSP_AUTHINV 6 = Invalid authentication method CHSR_CRSP_AUTHFAIL 7 = Authentication failure CHSR_CRSP_AUTHTIME 8 = Authentication time is invalid in Setup Request CHSR_CRSP_NOMAXBW 9 = No Maximum test Bit rate specified CHSR_CRSP_CAPEXC 10 = Server Maximum Bit rate exceeded CHSR_CRSP_BADTMTU 11 = MTU option does not match Server maxBandwidth Field MSB Code Bit: CHSR_USDIR_BIT 0x8000 Bandwidth upstream direction bit, Set for Upstream modifierBitmap Code Field: Setup CHSR_JUMBO_STATUS 0x01 = set to use Jumbo datagram sizes above 1Gbps CHSR_TRADITIONAL_MTU 0x02 = set to use datagrams for 1500 byte packets ]]> Figure 3 Organization/Definitions of Server Test Setup Response - Rejection There is a set of Command Response codes, beginning with: "2 = Bad Protocol Version", one of which SHOULD be communicated to indicate the cause when an error condition detected and testing cannot proceed:

Figure 4 Command Response Error Codes When indicating a Bad Protocol Version error and sending a response, the server SHALL update the protocolVer field in the Test Setup Response to indicate the current version supported.

If the server finds that the Setup Request matches its configuration and is otherwise acceptable, the server SHALL initiate a new connection to receive the Test Activation Request and other traffic from the client, using a new UDP socket allocated from the UDP ephemeral port range. Then, the server SHALL start a watchdog timer (to terminate the connection in case the client goes silent), and sends the Setup Response back to the client (see below for composition). When the Setup Request is accepted by the server, a Setup Response SHALL be sent back to the client with a corresponding command response value indicating 1 = Acknowledgement.

Figure 5 Organization/Definitions of Server Test Setup Response - Acceptance The Setup Response SHALL include the server-selected ephemeral port number (testPort field) for the new socket, and this server-selected UDP port SHALL be used for all subsequent communication. The server SHALL confirm, coerce, or populate the values of: protocolVersion Jumbo datagram support status (modifierBitmap), Traditional MTU (modifierBitmap), authMode (will be all zeroes if unauthenticated) maxBandwidth testPort (ephemeral port) testSessionId keyId authUnixTime (will be all zeroes if unauthenticated mode) authDigest or IV (will be all zeroes if unauthenticated) for the client's use on the new connection in its Setup Response, and calculate authDigest in the authenticated modes. When the server prepares to send the Test Setup Response, it SHALL: add the authUnixTime and calculate the authDigest for the response message using the method prescribed in Section 4.2.2 if operating in one of the Authenticated modes, or add the authUnixTime and encrypt the request message using the method prescribed in Section 4.2.4 if operating in the Partial Encryption mode, and then send the Test Setup Response message to the client. Finally, the new UDP connection associated with the new socket and port number is opened, and the server awaits communication there. To ensure that the server's local firewall will successfully deliver packets received for the new ephemeral port, the server SHALL immediately send a "dummy" packet with the corresponding 4-tuple values including the source and destination IP addresses and port numbers. The source port SHALL be the new ephemeral port. This operation allows communication to the server even when the server's local firewall prohibits open ranges of ephemeral ports. The packet is not expected to arrive successfully at the client if the client-side firewall blocks unexpected traffic. If the "dummy" packet arrives at the client, it is a confirmation that further exchanges are possible on the new port-pair (but this is not strictly necessary). The four Test Setup PDU fields shown below SHALL be used as the "dummy" packet PDU.

Figure 6 The "dummy" Packet PDU Format If a Test Activation Request is not subsequently received from the client on this new ephemeral port number before the watchdog timer expires, the server SHALL close the socket and deallocate the port.

When the client receives the Test Setup Response, it SHALL: process/validate the response message by checking the authDigest if operating in one of the Authenticated modes as prescribed in Section 4.2.2, or validate and decrypt the response message using the method prescribed in Section 4.2.4 if operating in the Partial Encryption mode, and then proceed to evaluate the other fields in the protocol, beginning with the protocol version, the controlID (to validate the type of message, Test Setup), cmdRequest for the role of the message (SHOULD be 2, Test Setup Response), the maxBandwidth requested for the test (if in use), and the modifierBitmap for use of options such as Jumbo datagram status and traditional MTU (1500 bytes). The value in the authUnixTime field is a 32-bit time stamp and a 5 minute tolerance window (+/- 2.5 minutes) SHALL be used (if in one of the Authenticated or Encrypted modes) to distinguish a subsequent replay of a Test Setup Response. Replay of most other fields would remain valid if there was no authUnixTime field in the PDU, although the testSessionId MUST be unique as well. The authUnixTime is covered by the authDigest hash or encrypted, as specified earlier. The authUnixTime field is expected to be MBZ in unauthenticated mode. IF the cmdResponse value indicates an error (values >1) the client SHALL display/report a relevant message to the user or management process and exit. If the client receives a Command Server Response code (CRSP) that is not equal to one of the codes defined above, then the client MUST terminate the connection and terminate operation of the current Setup Request. If the Command Server Response code (CRSP) value indicates success (cmdResponse=1) the client SHALL compose a Test Activation Request with all the test parameters it desires, such as the test direction, the test duration, etc., as described below.

This section is divided according to the sending and processing of the client, server, and again at the client. All messages defined in this section SHALL use UDP transport. The hosts SHALL calculate and include the UDP checksum, or check the UDP checksum as necessary.

Upon a successful setup exchange, the client SHALL then compose and send the Test Activation Request to the UDP port number the server communicated in the Test Setup Response (the new ephemeral port, and not the well-known port). The client SHALL compose Test Activation Request as follows:

Figure 7 Organization/Definitions of Client Test Activation Request The content of many of the unique fields in Figure 7 is defined above, or defined in Section 4 of and Appendix A of . Additional definitions are given below. srIndexConf is the Send Rate table index of the configured fixed or starting send rate (depending on whether CHTA_SRIDX_ISSTART is cleared or set respectively). The UDP PDU format of the Test Activation Request is as follows (big-endian AB):

Figure 8 Test Activation Request PDU Format The client SHALL apply the configuration for testPort modifierBitmap authMode testSessionID keyID and the remaining fields are populated based on default values or command-line options requested in the Test Setup Request and communicated/confirmed by the server in the Test Setup Response.

When operating in either of the authenticated modes (authMode 1 and authMode 2), the client SHALL follow the requirements of Section 4.2.2 (and 4.2.3 if applicable), and SHALL generate the authDigest field. The SHA-256 calculation SHALL cover all the preceding fields. The current Unix time SHALL be read and inserted immediately prior to the calculation (as immediately as possible). Computation of authDigest SHA-256 is specified in .

When operating in Unauthenticated mode (authMode 0), the requirements of Section 4.2.1 SHALL be followed.

When operating in the partial encryption mode, the client SHALL follow the requirements of Section 4.2.4 and SHALL encrypt the Test Activation Request PDU through the authUnixTime field, but no further. The current Unix time SHALL be read and inserted immediately prior to the encryption processing (as immediately as possible).

After the server receives the Test Activation Request on the new connection, it MUST choose to accept, ignore or modify any of the test parameters.

When evaluating the Test Activation Request, the server MAY allow the client to specify its own fixed or starting send rate. Alternatively, the server MAY enforce a maximum limit of the fixed or starting send rate which the client can successfully request. If the client's Test Activation Request exceeds the server's configured maximum, the server MUST either reject the request or coerce the value to the configured maximum bit rate, and communicate that maximum to the client in the Test Activation Response. The client can of course choose to end the test, as appropriate. Other parameters where the server has the OPTION to coerce the client to use values other than those in the Test Activation Request are (grouped by role): Load Adjustment Algo: lowThresh, upperThresh, useOwDelayVar, highSpeedDelta, slowAdjThresh, seqErrThresh, highSpeedDelta, ignoreOooDup, rateAdjAlgo. Test duration/intervals: trialInt, testIntTime, subIntPeriod Packet marking: ipTosByte Coersion is a step toward performing a test with the server-configured values; even though the client might prefer certain values the server gives the client an opportunity to run a test with different values than the preferred set. Note that the server has the option of completely rejecting the request and sending back an appropriate command response value: uint8_t cmdResponse; // Command response (set to 2, error) Whether this error response is sent or not depends on the Security mode of operation and the outcome of authDigest validation. If the Test Activation Request must be rejected (due to the reasons in the Command Response value=2 listed above), and In Authenticated modes, if the authDigest is valid, a Test Activation Response SHALL be sent back to the client with a corresponding command response value indicating the reason for the rejection. The server SHALL follow the requirements of Section 4.2.2 and insert the autDigest in the response. In Authenticated modes, if the authDigest is invalid, then the Test Activation Request SHOULD fail silently. The exception is for operations support: server administrators using Authentication are permitted to send a Setup Response to support operations and troubleshooting. If unauthenticated mode is selected, the Test Setup Request SHALL fail silently. If Partial Encrypted mode is used, only valid Test Activation Request packets will be decrypted for server processing and a Test Activation Response is REQUIRED. The server SHALL follow the requirements of Section 4.2.4 to encrypt the response. If Full Encrypted mode is used, only valid Test Activation Request packets will be forwarded up the stack for server processing and a Test Setup Response is possible if the server is configured to send responses for troubleshooting. The additional, non-authentication and non-encryption-related circumstances when a server SHALL not communicate the appropriate Command Response Code for an error condition (fail silently) are when: the Test Activation Request PDU size is not correct, the control ID is invalid, or a directed attack has been detected, in which case the server will allow Test Activation Requests to terminate silently. Attack detection is beyond the scope of this specification.

When the server sends the Test Activation Response, it SHALL set the cmd Response field to: uint8_t cmdResponse;// Command response (set to 1, ACK) The server SHALL generate the Test Activation Response, populating all parameters in the Test Activation Response to indicate each value acceptance/changes/coersion to the client. If the client has requested an upstream test, the server SHALL: include the transmission parameters from the first row of the sending rate table in the Sending Rate Structure (defined below), OR use the parameters from the configured send rate index (srIndexConf) of the sending rate table for a fixed rate test, or the starting rate index for a test with Load Adjustment (this option indicated in the Test Activation modifierBitmap) when these options are present. When generating the Test Activation Response (acceptance) for an upstream test, the server SHALL replace the 28 MBZ octets of the of the Test Activation Request with the Sending Rate Structure, which SHALL be organized as follows:

Figure 9 Sending Rate Structure Definitions with

Figure 10 Sending Rate Structure Format If activation continues, server prepares the new connection for an upstream OR downstream test. In the case of a downstream test, the server SHALL prepare to send with either a single timer to send status PDUs at the specified interval OR dual timers to send load PDUs based on the transmission parameters from the first row of the sending rate table in the Sending Rate Structure, OR the transmission parameters of the configured send rate index (srIndexConf) of the sending rate table, or starting rate index (indicated in the Test Activation modifierBitmap) when these options are present. The server SHALL then send the Test Activation Response back to the client, update the watchdog timer with a new time-out value, and set a test duration timer to eventually stop the test. Once the requirements of the chosen security mode have been met, the Test Activation Response is ready to be sent to the client:

When operating in either of the authenticated modes (authMode 1 and authMode 2), the server SHALL follow the requirements of Section 4.2.2 (and 4.2.3 if applicable), and SHALL generate the authDigest field. The SHA-256 calculation SHALL cover all the preceding fields. The current Unix time SHALL be read and inserted immediately prior to the calculation (as immediately as possible). Computation of authDigest SHA-256 is specified in .

When operating in Unauthenticated mode (authMode 0), the requirements of Section 4.2.1 SHALL be followed.

When operating in the partial encryption mode, the client SHALL follow the requirements of Section 4.2.4 and SHALL encrypt the Test Activation Response PDU through the authUnixTime field, but no further. The current Unix time SHALL be read and inserted immediately prior to the encryption processing (as immediately as possible).

When the client receives the Test Activation Response, it SHALL: process/validate the response message by checking the authDigest if operating in one of the Authenticated modes as prescribed in Section 4.2.2, or validate and decrypt the response message using the method prescribed in Section 4.2.4 if operating in the Partial Encryption mode, and then proceed to evaluate the other fields in the protocol. When the client receives the (vetted) Test Activation Response, it first checks the command response value. If the client receives a Test Activation Command Response value that indicates an error, the client SHALL display/report a relevant message to the user or management process and exit. If the client receives a Test Activation Command Response value that is not equal to one of the codes defined above, then the client MUST terminate the connection and terminate operation of the current Setup Request. If the client receives a Test Activation Command Response value that indicates success (CHTA_CRSP_ACKOK) the client SHALL update its configuration to use any test parameters modified by the server. Next, the client SHALL prepare its connection for either an upstream test with dual timers set to send load PDUs (based on the starting transmission parameters sent by the server), OR a downstream test with a single timer to send status PDUs at the specified interval. Then, the client SHALL stop the test initiation timer, set a new time-out value for the watchdog timer and start the timer (to detect if the server goes quiet). The connection is now ready for testing.

This section describes the Data phase of the protocol. The roles of sender and receiver vary depending whether the direction of testing is from server to client, or the reverse. All messages defined in this section SHALL use UDP transport. The hosts SHALL calculate and include the UDP checksum, or check the received UDP checksum before further processing, as necessary.

Testing proceeds with one end point sending load PDUs, based on transmission parameters from the sending rate table, and the other end point receiving the load PDUs and sending status messages to communicate the traffic measurements at the receiver (or to control the receiver). The watchdog timer at the receiver SHALL be reset each time a test PDU is received. See non-graceful test stop in Section 8 for handling the watchdog/NOTRAFFIC time-out expiration at each end-point. When the server is sending Load PDUs in the role of sender, it SHALL use the transmission parameters directly from the sending rate table via the index that is currently selected (which was based on the feedback in its received status messages). However, when the client is sending load PDUs in the role of sender, it SHALL use the discreet transmission parameters that were communicated by the server in its periodic status messages (and not referencing a sending rate table row). This approach allows the server to control the individual sending rates as well as the algorithm used to decide when and how to adjust the rate. The server uses a load adjustment algorithm which evaluates measurements, either its local measurements or the contents of received feedback messages. This approach is unique to this protocol; it provides the ability to search for the Maximum IP Capacity and specify specific sender behaviors that is absent from other testing tools. Although the algorithm depends on the protocol, it is not part of the protocol per se. The default algorithm (B) has three paths to its decision on the next sending rate: When there are no impairments present (no sequence errors, low delay variation), resulting in sending rate increase. When there are low impairments present (no sequence errors but higher levels of delay variation), so the same sending rate is retained. When the impairment levels are above the thresholds set for this purpose and "congestion" is inferred, resulting in sending rate decrease. Algorithm (B) also has two modes for increasing/decreasing the sending rate: A high-speed mode (fast) to achieve high sending rates quickly, but also back-off quickly when "congestion" is inferred from the measurements. Consecutive feedback intervals that have a supra-threshold count of sequence number anomalies and/or contain an upper delay variation threshold exception in all of the consecutive intervals are sufficient to declare "congestion" within a test. The threshold of consecutive feedback intervals SHALL be configurable with a default of 3 intervals. A single-step (slow) mode where all rate adjustments use the minimum increase or decrease of one step in the sending rate table. The single step mode continues after the first inference of "congestion" from measured impairments. An OPTIONAL load adjustment algorithm (designated C) has been defined in . Algorithm C operation and modes are similar to B, but C uses multiplicative increases in the fast mode to reach the Gigabit range quickly and adds the possibility to re-try the fast mode during a test (which improves the measurement accuracy in dynamic or error-prone access, such as radio access). On the other hand, the test configuration MAY use a fixed sending rate requested by the client, using the field below: uint16_t srIndexConf; // Configured sending rate index The client MAY communicate the desired fixed rate in its activation request. The reasons to conduct a fixed-rate test include stable measurement at the maximum determined by the load adjustment (search) algorithm, or the desire to test at a known subscribed rate without searching. The Load PDU SHALL have the following format and field definitions:

Figure 11 Load PDU Field Definitions The Test Load UDP PDU format is as follows (big-endian AB):

Figure 12 Load PDU Format The field udpPayloadContent is all zeroes, all ones, or a pseudo random binary sequence.

The receiver SHALL send a Status PDU to the sender during a test at the configured feedback interval. The watchdog timer at the test PDU sender SHALL be reset each time a Status PDU is received. See non-graceful test stop in Section 8 for handling the watchdog/NOTRAFFIC time-out expiration at each end-point. The Status PDUs are a key part of the server-client control loop. To protect against bit errors (checksum) or on-path attacks (something stronger), there is a requirement to calculate and include/check the UDP checksum. Also, AUTHENTICATED mode 2 that covers the Status PDU and will detect bit errors or attempts to replace values in the original packets. The Status PDU SHALL have the following format and field definitions:

Figure 13 Status PDU Field Definitions The Status (UDP payload) PDUs format is as follows (big-endian AB):

Figure 14 Status PDU Format Note that the Sending Rate Structure (28 octets) is defined in the Test Activation section. More details on the Status PDU measurement fields are provided in . Also note that the Sub-interval Saved Stats Structure (52 octets) SHALL be included (and populated as required when the server is in the receiver role in an upstream test) as defined below. The Sub-interval saved statistics structure for received traffic measurements SHALL be organized and formatted as follows:

Figure 15 Saved Interval Statistics Structure, Definitions and Format Note that the 52 octet saved statistics structure above has slight differences from the 40 octets that follow in the status feedback PDU, particularly the time-related fields. The Authentication (and Encryption) Fields appear at the end of the Status PDU and SHALL be organized as follows:

Figure 16 Organization of Authentication Field Format The Authentication (and Encryption) Fields and their operation are as defined previously in Sections 5 and 6. When a client or server prepares to send the Status PDU, it SHALL: add the authUnixTime and calculate the authDigest for the response message using the method prescribed in Section 4.2.2 if operating in one of the Authenticated modes, or add the authUnixTime and encrypt the request message using the method prescribed in Section 4.2.4 if operating in the Partial Encryption mode, and then sends the Status PDU message to the other end-point. Upon receiving a Status Feedback PDU which has been validated and vetted according to the mode of operation (Authenticated mode 2 or Partial Encryption mode 3), the server SHALL perform calculations required by the selected Load adjustment algorithm (see Appendix A of or Annex B of ) and adjust its sending rate, or signal that the client adjust its sending rate in its role as as sender (via the Status PDU Sending Rate Structure).

When the test duration timer on the server expires, it SHALL set the connection test action to STOP and mark all outgoing load or status PDUs with a test action of STOP1. uint8_t testAction; // Test action (server sets STOP1) This is simply a non-reversible state for all future messages sent from the server. When the client receives a load or status PDU with the STOP1 indication, it SHALL finalize testing, display the test results, and also mark its connection with a test action of STOP (so that any PDUs received subsequent to the STOP1 are ignored). With the test action of the client's connection set to STOP, the very next expiry of a send timer for either a load or status PDU SHALL cause the client to schedule an immediate end time to exit. The client SHALL then send all subsequent load or status PDUs with a test action of STOP2. uint8_t testAction; // Test action (client sets STOP2) as confirmation to the server, and a graceful termination of the test can begin. When the server receives the STOP2 confirmation in the load or status PDU, the server SHALL schedule an immediate end time for the connection which closes the socket and deallocates it. In a non-graceful test stop due to path failure, the watchdog/NOTRAFFIC time-outs at each end-point will expire (sometimes at one end-point first), notifications in logs, STDOUT, and/or formatted output SHALL be made, and the test action of each end-point's connection SHALL be set to STOP. If an attacker clears STOP1 or STOP2 bits, then the configured testIntTime (test duration) value at the server and/or client will take action and stop sending its test stream.

The architecture of the method REQUIRES two cooperating hosts operating in the roles of Src (test packet sender) and Dst (receiver), with a measured path and return path between them. The duration of a test duration, parameter I, MUST be constrained in a production network, since this is an active test method and it will likely cause congestion on the Src to Dst host path during a test.

Additional measurements may be useful in specific circumstances. For example, interface byte counters measured by a client at a residential gateway are possible when the client application has access to an interface that sees all traffic to/from a service subscriber's location. Adding a byte counter at the client for download or upload directions could be used to measure total traffic and possibly detect when non-test traffic is present (and using capacity). The client may not have the CPU cycles available to count both the interface traffic and IP-layer Capacity simultaneously, so this form of diagnostic measurement may not be possible.

This section is for the benefit of the Document Shepherd's form, and will be deleted prior to publication. Much of the development of the method and comparisons with existing methods conducted at IETF Hackathons and elsewhere have been based on the example udpst Linux measurement tool (which is a working reference for further development) . The current project: is a utility that can function as a client or server daemon requires a successful client-initiated setup handshake between cooperating hosts and allows firewalls to control inbound unsolicited UDP which either go to a control port [expected and w/authentication] or to ephemeral ports on the client and server that are only created as needed. permits firewalls protecting each host to continue to do their job normally. This aspect is similar to many other test utilities available. The firewall at the server will need to open a pin-hole for the control port, the dynamic ephemeral port in response to the "dummy packet" (or open a limited range of ephemeral ports) to complete the second control exchange: Test Activation, where the client communicates to the server on an ephemeral destination port *assigned by the server*. has Authentication modes that require a secret key included in the SHA-256 HMAC calculation which utilizes the OpenSSL HMAC macro (https://www.openssl.org/docs/man3.0/man3/HMAC.html). is written in C, and built with gcc (release 9.3) and its standard run-time libraries allows configuration of most of the parameters described in Sections 4 through 8. supports IPv4 and IPv6 address families. supports IP-layer packet marking. supports the upstream and downstream interface byte counter measurements at the client, and the results are available in the Text and JSON output at the end of a test.

Active metrics and measurements have a long history of security considerations. The security considerations that apply to any active measurement of live paths are relevant here. See and . When considering privacy of those involved in measurement or those whose traffic is measured, the sensitive information available to potential observers is greatly reduced when using active techniques which are within this scope of work. Passive observations of user traffic for measurement purposes raise many privacy issues. We refer the reader to the privacy considerations described in the Large Scale Measurement of Broadband Performance (LMAP) Framework , which covers active and passive techniques. There are some new considerations for Capacity measurement as described in this memo. Cooperating client and server hosts and agreements to test the path between the hosts are REQUIRED. Hosts perform in either the server or client roles. One way to assure a cooperative agreement employs the optional Authorization mode through the use of the authDigest field and the known identity associated with the key used to create the authDigest field. Other means are also possible, such as access control lists at the server. It is REQUIRED to have a user client-initiated setup handshake between cooperating hosts that allows firewalls to control inbound unsolicited UDP traffic which either goes to a control port [expected and w/authentication] or to ephemeral ports that are only created as needed. Firewalls protecting each host can both continue to do their job normally. Client-server authentication and integrity protection for feedback messages conveying measurements is REQUIRED. To accommodate different host limitations and testing circumstances, different modes of operation are recommended, as described in Section 4 above. Hosts MUST limit the number of simultaneous tests to avoid resource exhaustion and inaccurate results. Senders MUST be rate-limited. This can be accomplished using a pre-built table defining all the offered load rates that will be supported (Section 8.1). The default and optional load-control search algorithm result in "ramp up" from the lowest rate in the table. Service subscribers with limited data volumes who conduct extensive capacity testing might experience the effects of Service Provider controls on their service. Testing with the Service Provider's measurement hosts SHOULD be limited in frequency and/or overall volume of test traffic (for example, the range of test interval duration values SHOULD be limited). One specific attack that has been recognized is an on-path attack on the Test STOP bits where the attacker would clear or set the bits. Adding the STOP bits to successive packets terminates the test prematurely, with no threat to the Internet but annoyance for the testers. If an attacker clears the STOP bits, the mitigation relies on knowledge of the test duration at the client and server, where these hosts cease all traffic when the specified test duration is complete.

This memo requests IANA to assign a "well-known" UDP port for the Test Setup exchange in the Control phase of protocol operation, and to create a new registry group for the UDP Speed Test (UDPST) protocol.

udpst-control UDP IESG <iesg@ietf.org> IETF Chair <chair@ietf.org> UDP-based IP-Layer Capacity and performance measurement protocol This RFC, RFCYYYY. The protocol uses IP-Layer Unicast. <left blank, as instructed>

This section describes the design of the UDP Speed Test (UDPST) registry group. The new registry group SHALL be named, "UDPST Registry". The following applies to each registry in the sub-sections below: Registration Procedure: Specification Required Reference: <This RFC> Experts: Performance Metrics Experts Note: TBD

The first two octets of the PDUs used in the UDPST protocol identify the role and format of PDU that follows.

IETF Test Setup PDU controlId 0xACE2 IETF Test Activation PDU loadId 0xBEEF IETF Load PDU statusId 0xFEED IETF Status Feedback PDU ]]> Other values are unassigned.

The second two octets of the PDUs used in the UDPST protocol identify the version of the protocol in use. The table below defines the assigned decimal values in the registry.

IETF Reserved protocolVer 8 IETF Protocol version 8 protocolVer 9 IETF Protocol version 9 protocolVer 10 IETF Protocol version 10 ]]> Other values are unassigned, with an upper value of 65535.

The Test Setup PDU layout contains a modifierBitmap field. The table below defines the initial bit assignments in the registry.

IETF No modifications modifierBitmap 0x01 IETF Do not use Jumbo Frames above sending rates of 1Gbps modifierBitmap 0x02 IETF Use Traditional MTU (1500 bytes with IP-header) modifierBitmap 0x03-0xFF IETF Unassigned ]]>

The Test Setup PDU layout contains an authMode field. The table below defines the assigned decimal values in the registry, and a range for experimentation.

IETF OPTIONAL unauthenticated mode authMode 1 IETF REQUIRED authentication for the Control phase authMode 2 IETF OPTIONAL authentication for the Data phase, in addition to the Control phase authMode 3 IETF OPTIONAL partial encrypted mode authMode 60-63 IETF Range for experimentation ]]> Other values are unassigned, with the upper boundary of 255.

The Test Setup PDU layout contains an cmdResponse field. The table below defines the assigned decimal values in the registry.

IETF None (value used by client in Request) cmdResponse 1 IETF Acknowledgement cmdResponse 2 IETF Bad Protocol Version cmdResponse 3 IETF Invalid Jumbo datagram option cmdResponse 4 IETF Unexpected Authentication in Setup Request cmdResponse 5 IETF Authentication missing in Setup Request cmdResponse 6 IETF Invalid authentication method cmdResponse 7 IETF Authentication failure cmdResponse 8 IETF Authentication time is invalid in Setup Request cmdResponse 9 IETF No Maximum test Bit rate specified cmdResponse 10 IETF Server Maximum Bit rate exceeded cmdResponse 11 IETF MTU option does not match Server ]]> Other values are unassigned, with the upper boundary of 255.

The Test Activation PDU layout (also) contains a modifierBitmap field. The table below defines the initial bit assignments in the registry.

IETF No modifications modifierBitmap 0x01 IETF Set when srIndexConf is START rate for search modifierBitmap 0x02 IETF Set for RANDOMIZED UDP payload modifierBitmap 0x03-0xFF IETF Unassigned ]]>

The Test Activation PDU layout contains a cmdRequest field. The table below defines the assigned decimal values in the registry.

IETF No Request cmdRequest 1 IETF Request test in Upstream direction (client to server) cmdRequest 2 IETF Request test in Downstream direction (server to client) ]]> Other values are unassigned, with the upper boundary of 255.

The Test Activation PDU layout contains a rateAdjAlgo field. The table below defines the assigned Capitalized alphabetic UTF-8 @@@@ values in the registry.

IETF Not used rateAdjAlgo B IETF Rate algorithm Type B rateAdjAlgo C IETF Rate algorithm Type C ]]> Other values are unassigned, with the upper boundary of Z.

The Test Activation PDU layout (also) contains a cmdResponse field. The table below defines the assigned decimal values in the registry.

IETF None (value used by client in Request) cmdResponse 1 IETF Server Acknowledgement cmdResponse 2 IETF Server indicates an error ]]> Other values are unassigned, with the upper boundary of 255.

This specification has been edited by Al Morton. Al Morton died before he was able to finalise this work. As Al can't complete author tasks during the IETF standardisation process anymore, it was decided not to keep him as an author in the proper section. Respecting, that almost all of the content here has been edited or created by Al, it seems fair not just to give him credit for his work, but also list him as editor, if this document reaches RFC status. Thanks to Lincoln Lavoie, Can Desem, and Greg Mirsky for reviewing this draft and providing helpful suggestions and areas for further development. Ken Kerpez and Chen Li have provided helpful reviews. Amanda Baber provided early reviews of the IANA Considerations section. Brian Weis provided an early SEC-DIR review; version 02 captures clarifications and version 03 takes on the protocol changes the Brian suggested.