Minimal Encapsulation within IP
A lighter IP tunnel that inserts a small forwarding header instead of wrapping a whole second IP header.
Perkins, C., "Minimal Encapsulation within IP", RFC 2004, DOI 10.17487/RFC2004, October 1996, <https://www.rfc-editor.org/info/rfc2004>.
@misc{rfc2004,
series = {Request for Comments},
number = 2004,
howpublished = {RFC 2004},
publisher = {RFC Editor},
doi = {10.17487/RFC2004},
url = {https://www.rfc-editor.org/info/rfc2004},
author = {C. Perkins},
title = {{Minimal Encapsulation within IP}},
pagetotal = 6,
year = 1996,
month = oct,
} RFC text
Contents
Network Working Group C. Perkins
Request for Comments: 2004 IBM
Category: Standards Track October 1996
Minimal Encapsulation within IP
Status of This Memo
This document specifies an Internet standards track protocol for the
Internet community, and requests discussion and suggestions for
improvements. Please refer to the current edition of the "Internet
Official Protocol Standards" (STD 1) for the standardization state
and status of this protocol. Distribution of this memo is unlimited.
Abstract
This document specifies a method by which an IP datagram may be
encapsulated (carried as payload) within an IP datagram, with less
overhead than "conventional" IP encapsulation that adds a second IP
header to each encapsulated datagram. Encapsulation is suggested as
a means to alter the normal IP routing for datagrams, by delivering
them to an intermediate destination that would otherwise not be
selected by the (network part of the) IP Destination Address field in
the original IP header. Encapsulation may be serve a variety of
purposes, such as delivery of a datagram to a mobile node using
Mobile IP.
1. Introduction
This document specifies a method by which an IP datagram may be
encapsulated (carried as payload) within an IP datagram, with less
overhead than "conventional" IP encapsulation [4] that adds a second
IP header to each encapsulated datagram. Encapsulation is suggested
as a means to alter the normal IP routing for datagrams, by
delivering them to an intermediate destination that would otherwise
not be selected by the (network part of the) IP Destination Address
field in the original IP header. The process of encapsulation and
decapsulation of a datagram is frequently referred to as "tunneling"
the datagram, and the encapsulator and decapsulator are then
considered to be the the "endpoints" of the tunnel; the encapsulator
node is refered to as the "entry point" of the tunnel, and the
decapsulator node is refered to as the "exit point" of the tunnel.
2. Motivation
The Mobile IP working group has specified the use of encapsulation as
a way to deliver packets from a mobile node's "home network" to an
agent that can deliver datagrams locally by conventional means to the
mobile node at its current location away from home [5]. The use of
encapsulation may also be indicated whenever the source (or an
intermediate router) of an IP datagram must influence the route by
which a datagram is to be delivered to its ultimate destination.
Other possible applications of encapsulation include multicasting,
preferential billing, choice of routes with selected security
attributes, and general policy routing.
See [4] for a discussion concerning the advantages of encapsulation
versus use of the IP loose source routing option. Using IP headers
to encapsulate IP datagrams requires the unnecessary duplication of
several fields within the inner IP header; it is possible to save
some additional space by specifying a new encapsulation mechanism
that eliminates the duplication. The scheme outlined here comes from
the Mobile IP Working Group (in earlier Internet Drafts), and is
similar to that which had been defined in [2].
3. Minimal Encapsulation
A minimal forwarding header is defined for datagrams which are not
fragmented prior to encapsulation. Use of this encapsulating method
is optional. Minimal encapsulation MUST NOT be used when an original
datagram is already fragmented, since there is no room in the minimal
forwarding header to store fragmentation information. To encapsulate
an IP datagram using minimal encapsulation, the minimal forwarding
header is inserted into the datagram, as follows:
+---------------------------+ +---------------------------+
| | | |
| IP Header | | Modified IP Header |
| | | |
+---------------------------+ ====> +---------------------------+
| | | Minimal Forwarding Header |
| | +---------------------------+
| IP Payload | | |
| | | |
| | | IP Payload |
+---------------------------+ | |
| |
+---------------------------+
The IP header of the original datagram is modified, and the minimal
forwarding header is inserted into the datagram after the IP header,
followed by the unmodified IP payload of the original datagram (e.g.,
transport header and transport data). No additional IP header is
added to the datagram.
In encapsulating the datagram, the original IP header [6] is modified
as follows:
- The Protocol field in the IP header is replaced by protocol
number 55 for the minimal encapsulation protocol.
- The Destination Address field in the IP header is replaced by the
IP address of the exit point of the tunnel.
- If the encapsulator is not the original source of the datagram,
the Source Address field in the IP header is replaced by the IP
address of the encapsulator.
- The Total Length field in the IP header is incremented by the
size of the minimal forwarding header added to the datagram.
This incremental size is either 12 or 8 octets, depending on
whether or not the Original Source Address Present (S) bit is set
in the forwarding header.
- The Header Checksum field in the IP header is recomputed [6] or
updated to account for the changes in the IP header described
here for encapsulation.
Note that unlike IP-in-IP encapsulation [4], the Time to Live
(TTL) field in the IP header is not modified during encapsulation;
if the encapsulator is forwarding the datagram, it will decrement
the TTL as a result of doing normal IP forwarding. Also, since
the original TTL remains in the IP header after encapsulation,
hops taken by the datagram within the tunnel are visible, for
example, to "traceroute".
The format of the minimal forwarding header is as follows:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Protocol |S| reserved | Header Checksum |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Original Destination Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
: (if present) Original Source Address :
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Protocol
Copied from the Protocol field in the original IP header.
Original Source Address Present (S)
0 The Original Source Address field is not present. The
length of the minimal tunneling header in this case is
8 octets.
1 The Original Source Address field is present. The
length of the minimal tunneling header in this case is
12 octets.
reserved
Sent as zero; ignored on reception.
Header Checksum
The 16-bit one's complement of the one's complement sum of all
16-bit words in the minimal forwarding header. For purposes of
computing the checksum, the value of the checksum field is 0.
The IP header and IP payload (after the minimal forwarding
header) are not included in this checksum computation.
Original Destination Address
Copied from the Destination Address field in the original IP
header.
Original Source Address
Copied from the Source Address field in the original IP header.
This field is present only if the Original Source Address
Present (S) bit is set.
When decapsulating a datagram, the fields in the minimal forwarding
header are restored to the IP header, and the forwarding header is
removed from the datagram. In addition, the Total Length field in
the IP header is decremented by the size of the minimal forwarding
header removed from the datagram, and the Header Checksum field in
the IP header is recomputed [6] or updated to account for the changes
to the IP header described here for decapsulation.
The encapsulator may use existing IP mechanisms appropriate for
delivery of the encapsulated payload to the tunnel exit point. In
particular, use of IP options are allowed, and use of fragmentation
is allowed unless the "Don't Fragment" bit is set in the IP header.
This restriction on fragmentation is required so that nodes employing
Path MTU Discovery [3] can obtain the information they seek.
4. Routing Failures
The use of any encapsulation method for routing purposes brings with
it increased susceptibility to routing loops. To cut down the
danger, a router should follow the same procedures outlined in [4].
5. ICMP Messages from within the Tunnel
ICMP messages are to be handled as specified in [4], including the
maintenance of tunnel "soft state".
6. Security Considerations
Security considerations are not addressed in this document, but are
generally similar to those outlined in [4].
7. Acknowledgements
The original text for much of Section 3 was taken from the Mobile IP
draft [1]. Thanks to David Johnson for improving consistency and
making many other improvements to the draft.
References
[1] Perkins, C., Editor, "IPv4 Mobility Support", Work in Progress,
May 1995.
[2] David B. Johnson. Scalable and Robust Internetwork Routing
for Mobile Hosts. In Proceedings of the 14th International
Conference on Distributed Computing Systems, pages 2--11, June
1994.
[3] Mogul, J., and S. Deering, "Path MTU Discovery", RFC 1191,
November 1990.
[4] Perkins, C., "IP Encapsulation within IP", RFC 2003,
October 1996.
[5] Perkins, C., Editor, "IP Mobility Support", RFC 2002,
October 1996.
[6] Postel, J., Editor, "Internet Protocol", STD 5, RFC 791,
September 1981.
Author's Address
Questions about this memo can be directed to:
Charles Perkins
Room H3-D34
T. J. Watson Research Center
IBM Corporation
30 Saw Mill River Rd.
Hawthorne, NY 10532
Work: +1-914-784-7350
Fax: +1-914-784-6205
EMail: perk@watson.ibm.com
The working group can be contacted via the current chair:
Jim Solomon
Motorola, Inc.
1301 E. Algonquin Rd.
Schaumburg, IL 60196
Work: +1-847-576-2753
EMail: solomon@comm.mot.com
AI ELI5
On this page
§1Encapsulation and Tunnels
RFC 2004 specifies a way to carry an IP datagram as the payload of an IP datagram with less overhead than the conventional method in RFC 2003, which adds a second IP header to each datagram. Encapsulation is a means to alter normal IP routing by delivering a datagram to an intermediate destination that the original Destination Address would not select.
The process is often called tunneling. The encapsulator is the entry point of the tunnel and the decapsulator is the exit point.
A tunnel is a shortcut for a package. It goes in at one end, and someone at the other end hands it on to where it was really going.
§2Why a Smaller Encapsulation
The Mobile IP working group specified encapsulation as a way to deliver packets from a mobile node's home network to an agent that can deliver them locally to the mobile node, wherever it is away from home. Other possible uses the RFC lists are multicasting, preferential billing, choice of routes with selected security attributes, and general policy routing.
Using a full IP header to encapsulate duplicates several fields in the inner header. A new mechanism can save space by eliminating that duplication. The scheme comes from earlier Mobile IP Internet Drafts.
When a friend moves house, mail still goes to the old address and gets forwarded. A forwarding label that repeats less information makes the forwarded parcel lighter.
§3How Encapsulation Works
Use of minimal encapsulation is optional. The minimal forwarding header is inserted after the IP header, followed by the unmodified payload, and no extra IP header is added. The original IP header is modified like this:
- The Protocol field becomes protocol number
55. - The Destination Address becomes the IP address of the tunnel exit point.
- If the encapsulator is not the original source, the Source Address becomes the encapsulator's address.
- The Total Length grows by the size of the forwarding header, either 12 or 8 octets depending on the S bit.
- The Header Checksum is recomputed or updated.
Unlike IP-in-IP encapsulation, the Time to Live is not changed by encapsulation itself. A forwarding encapsulator decrements it through normal forwarding. Because the original TTL stays in the header, hops inside the tunnel are visible to tools such as traceroute.
Decapsulation reverses this. The forwarding header fields are restored to the IP header, the header is removed, Total Length is decremented by its size, and the Header Checksum is recomputed or updated.
The encapsulator may use existing IP mechanisms to deliver to the exit point. IP options are allowed, and fragmentation is allowed unless the Don't Fragment bit is set, so that nodes using Path MTU Discovery can get the information they need.
Going in, you cross out the address and write the tunnel exit's address, and stick the old one on a note. Coming out, you peel off the note and put the old address back.
§3.1The Minimal Forwarding Header
The header has a Protocol field, an S bit, a reserved field, a 16-bit Header Checksum, the Original Destination Address, and optionally the Original Source Address.
- Protocol is copied from the original IP header.
- S is 0 when the source address is absent, making the header 8 octets, and 1 when present, making it 12 octets.
- reserved is sent as zero and ignored on reception.
- Header Checksum is the 16-bit one's complement of the one's complement sum of all 16-bit words in the minimal forwarding header, computed with the checksum field as 0. The IP header and payload are not included.
- Original Destination Address is copied from the original header.
- Original Source Address is copied from the original header and is present only when S is set.
Minimal encapsulation MUST NOT be used when the original datagram is already fragmented, since the header has no room for fragmentation information.
The sticky note holds the old destination, sometimes the old sender, and a small check number to spot mistakes. It has no space for notes about a parcel that was already split up, so those cannot use it.
| Field | Name | Size | Value | Description |
|---|---|---|---|---|
PROTOCOL | Protocol | 1 byte | Copied from the Protocol field of the original IP header. | |
S | S | 1 bits | 1 if the Original Source Address is present, which makes the header 12 octets; 0 for 8 octets. | |
RESERVED | reserved | 7 bits | Sent as zero; ignored on reception. | |
CHECKSUM | Header Checksum | 2 bytes | Checksum over the minimal forwarding header only. | |
ORIG-DST | Original Destination Address | 4 bytes | Copied from the original IP header. |
§4Routing Failures and ICMP
Using any encapsulation for routing makes routing loops more likely. To reduce the danger, a router should follow the procedures in RFC 2003. ICMP messages from within the tunnel are also handled as that RFC specifies, including the maintenance of tunnel soft state.
Shortcuts can send a package round in circles. This RFC says to follow the same safety rules as the bigger-envelope method.
§5Security Considerations
The RFC does not address security itself. It says the considerations are generally similar to those in RFC 2003, which defines the conventional IP-in-IP method.
This note does not add any new safety rules. It points to the ones for the bigger-envelope method.