Summary

  • Two active SPRING working-group drafts define a Timestamp and Forward loopback mode for SRv6 and SR-MPLS. A reflector writes receive timestamp T2 into an unauthenticated STAMP packet in the forwarding fast path, avoiding a punt for ordinary reflector processing and supporting more sessions at shorter intervals.
  • The value can be useful inside a controlled administrative domain, but it does not authenticate its writer, path, clock or authorized use. A mode-and-trust receipt should bind each series to admission controls, data-plane mode, path, service context, clock state, validation results and the exact decisions the evidence is allowed to inform.

The number arrived before its authority did

At 02:17 a controller sees a delay series cross a threshold. The samples are fresh, frequent and unusually clean. An automated policy is ready to move a segment-routed service away from the measured path. The data looks more current than yesterday’s slower measurements because the reflector has stamped each packet without sending it to a control-plane process.

One field is easy to miss: the session used loopback with Timestamp and Forward, or TSF. The receive time was written in the fast path. The packet format was unauthenticated.

That fact need not stop the route change. It should stop a different and more consequential shortcut: treating the precision of the number as proof of the identity and authority behind it. A nanosecond-shaped value can be exact as a representation while remaining incomplete as institutional evidence. The question is not only whether T2 was written. It is who was allowed to cause that write, on which reflector, along which provisioned paths, under which clock condition, and for what subsequent decision.

What the fast path buys

The SRv6 and SR-MPLS drafts solve a genuine scaling problem. Ordinary STAMP reflector work requires protocol processing away from the forwarding fast path. TSF instead returns the Session-Sender packet after inserting receive timestamp T2 in the data plane. The sender already placed transmit time T1 in the packet and records return time T4 locally. It can derive forward one-way delay from T2 minus T1 and loopback delay from T4 minus T1.

Avoiding the punt can support a larger number of sessions and shorter measurement intervals. Those are not cosmetic improvements. More frequent samples can reveal transient congestion, accelerate anomaly detection and let an operator distinguish a sustained impairment from a coarse polling artefact. Data-plane execution can also reduce variation introduced by software scheduling at the reflector.

The drafts keep the two forwarding technologies distinct. SRv6 uses proposed End.TSF behaviours for PTPv2 and NTPv4 formats, bound to SIDs on capable reflectors. SR-MPLS uses proposed MPLS Network Action opcodes carried in the MNA sub-stack. In both cases the timestamp is written at the specified place in the STAMP payload, and the packet is returned without the full reflector path.

This symmetry at the design level should not erase operational differences. A receipt must state which data plane and encoding were used. An SRv6 boundary filter is not evidence that an MPLS action was constrained, and support for one proposed behaviour does not establish support for another.

The exclusion is part of the result

The drafts are unusually direct about the trade-off: loopback with TSF supports only the unauthenticated Session-Reflector packet defined by RFC 8972 and does not support the authenticated packet. RFC 8762’s authenticated mode uses HMAC-SHA-256, truncated to 128 bits, to protect STAMP message integrity. Its key management is outside the base specification, but the presence and successful verification of the HMAC still make a different claim from an unauthenticated packet.

The right conclusion is not that every TSF result is untrustworthy. The procedures are intended for one administrative domain. The operator provisions the sender, reflector and forward and return paths. TSF processing is to be restricted to trusted nodes and trusted sessions, with relevant packets filtered at the domain boundary. Implementations must validate the selected behaviour or action, timestamp format, offset and available payload before writing. Malformed input must be dropped.

Those controls create a bounded operating environment. They do not silently add authenticated STAMP to a packet format that excludes it. Trust may be supplied by topology, admission, configuration, encapsulation protection, physical control, correlation and monitoring. If so, the evidence record should name those controls. Otherwise a later consumer sees only the timestamp and inherits assumptions it cannot inspect.

Integrity, accuracy and representativeness are different

Three questions often collapse in a dashboard.

First, was the message modified or fabricated? Authenticated STAMP can protect message integrity when its keys and verification are correctly managed. TSF does not use that authenticated packet format. Separate protection, such as SRH HMAC in the SRv6 case, may contribute at another layer, but it must be recorded as a separate control rather than implied by the timestamp.

Second, was the clock good enough for the claim? Computing one-way delay from T2 minus T1 requires synchronized sender and reflector clocks using NTPv4 or PTPv2. The timestamp format is not a certificate that synchronization was healthy. Clock source, last synchronization, estimated error and holdover condition belong with the series. Loopback delay derived from T4 minus T1 avoids the same cross-clock subtraction, while round-trip packet loss has another evidence basis again.

Third, did the probe represent the traffic and service named in the conclusion? STAMP packets can be sent with the same segment-routing encapsulation as the traffic under measurement, and explicit return paths can be provisioned. Yet a correctly returned probe does not prove that every application flow used the same ECMP member, queue treatment or service context. The drafts correctly insist that packets received through a transport path or service context be processed only there; they do not create a cross-service authorization mechanism.

An HMAC cannot make a drifting clock accurate. A synchronized clock cannot authenticate an injected packet. A correctly admitted probe cannot prove that a broad customer population experienced the same path. Keeping those propositions separate is more useful than awarding the measurement one undifferentiated “trusted” badge.

A receipt for the series, not a seal on each number

The missing governance object sits above the packet. For every series that may trigger a consequential action, the operator should retain a compact mode-and-trust receipt.

It should name the session, sender, reflector and accountable operator; the SRv6 or SR-MPLS data plane; the two-way, one-way, loopback or TSF mode; and whether the STAMP packet format was authenticated. It should fingerprint the configured forward and return paths, encapsulation and segment list. It should bind the service or tenant context and record the mechanism that prevents cross-context processing.

For TSF, the record should identify the selected End.TSF behaviour or MPLS opcode, timestamp format, payload offset and reflector capability result. It should preserve the sender-admission rule, boundary filters, session-identifier policy and any protection supplied outside STAMP. Clock source, synchronization health, error estimate and last check belong beside the interpretation of T1, T2 and T4.

The operational half should include probe rate, interval, sample count, rejected or malformed packets, write failures, loss, delay and validation outcomes. The policy half should preserve the aggregation window, outlier rule, threshold, uncertainty, owner and the precise action the series may inform. Raw captures and secret keys need not be disclosed. Hashes and bounded facts can support reconstruction without turning the receipt into a topology leak.

The receipt should expire. A changed segment list, new reflector software, altered boundary policy, lost clock synchronization, service migration or new decision use should trigger reissue. A result that was admissible for an internal alert yesterday should not automatically become admissible evidence for a customer credit tomorrow.

Faster observation can accelerate a bad decision

The attractive feature of TSF is also the reason governance matters. Shorter intervals make measurements more actionable. When the action is automated, a missing boundary can propagate at the same speed.

Consider three consumers. An operations console uses TSF to flag a possible impairment and sends an engineer to compare independent telemetry. A traffic-engineering controller automatically changes a candidate path after five bad samples. A commercial system computes an SLA breach and issues a customer credit. They can read the same series and still require different proof. The alert may tolerate provisional evidence. The route change needs stability and rollback rules. The contractual consequence needs a preserved method, scope and dispute trail.

The packet cannot decide which consumer is entitled to act. That remains a local institutional choice. A shared protocol should carry the minimum interoperable measurement structure; each operator should declare the future decisions it allows the result to support. This is the practical value of Heng Lu’s minimum-specification principle: standardization can make local decisions comparable without centralizing them.

Work in progress, not a deployed verdict

Both documents are active Internet-Drafts dated 12 September 2026 and intended as Informational work. Their proposed End.TSF behaviours and MPLS opcodes remain to be assigned. Implementation-status text reports specific work, but that is not evidence of universal support, operational scale or production policy.

Nor do the documents claim that TSF authenticates what it does not authenticate. They explicitly preserve the boundary and add meaningful controls: trusted sessions, domain filtering, capability checks, bounds validation, counters and rate-limited notifications. The governance failure would occur later, if an institution exports only the polished delay number and discards the conditions under which it became usable.

A fast-path timestamp can be excellent measurement material. It becomes accountable evidence only when the organization keeps the mode, trust and decision context attached.

Sources