Summary

  • A 1 November revision of an individual FlowSpec draft adds an explicit deployment rule: a router that understands the new D bit invalidates a Redirect-to-IPv4 policy when its directly connected target link fails; an older receiver must ignore the bit and keep processing the policy.
  • Revision 01 confines the bit to the IPv4 redirect extended community and assigns it bit position 14. The July version also proposed an IPv6 form and did not spell out the mixed-fleet rule.
  • The draft illustrates a detour and a forwarding loop in particular topologies. It reports no outage or interoperable deployment of this new protection.

The controller's instruction meets the router's vocabulary

An SDN controller sends a FlowSpec rule that diverts matching traffic to the IP address on the far end of a directly connected link. In the draft's example, the shortcut link fails. A router that still resolves the target address through a less-specific route can keep the redirect alive and send packets on an unwanted detour; in the second depicted topology, packets can circle until their TTL expires. The new revision proposes the D bit as a direct-link condition. The July revision already had the central idea. The November change makes the boundary sharper.

A supporting router with D=1 associates the redirect target with the actual direct link. When that link becomes unavailable, it marks the FlowSpec policy invalid and stops applying its redirect. It must not preserve the detour merely because an aggregate or default route still resolves the target IP. Another policy can handle the packet; otherwise ordinary destination forwarding takes over. On link recovery, the router can reactivate the policy without waiting for the controller to advertise it again, provided the route is otherwise valid. The draft leaves failure detection, such as BFD or neighbor checks, to implementations.

Section 5 then writes the compatibility bargain. A receiver that knows Redirect-to-IPv4 but not D MUST ignore the new bit and continue processing the rule; it MUST NOT discard the route solely because D is present. This keeps old equipment from dropping a policy it otherwise understands. It also means the new link-loss protection does not follow the policy into that equipment. Even a modern router gains nothing for an old rule with D=0. The revision now puts D at previously undefined bit 14 in the IPv4 community and removes the proposed IPv6 form from its scope.

The file is an individual, Standards-Track-intended Internet-Draft, not an adopted IETF rule. The precise operational question for a rollout is no longer just whether the controller set the bit. It is which receiving routers read it, which policies carry it, and what each router does when the target link disappears.