Summary

  • Revision 01 proposes CASH and PASH packets that compare hashes of link-state database ranges, then refine only the ranges that differ.
  • A match is evidence that two summaries agree under the specified construction. It is not proof of origin, topology truth, forwarding installation or service delivery.
  • The revision's new dependency on a generic Hello Capability draft makes version control, mixed-fleet fallback and parser testing part of the deployment decision.

At large scale, asking two routers to recite every link-state record is expensive. The new draft-prz-lsr-ash-packets-01, submitted on 6 September, proposes that they begin with a compressed question instead: do hashes covering these ranges of the database agree?

If they do, the peers move on. If they do not, Complete and Partial Aggregated SNP Hash packets—CASH and PASH—divide the disputed range until ordinary sequence-number packets or flooding repair the remaining difference. The draft analyzes an outer case of 50,000 nodes, one million fragments and 16,000 peers. Its arithmetic reduces a full exchange from roughly 10,000 CSNP packets toward a handful of summaries, while leaving refresh flooding as a substantial burden.

That is a useful engineering proposal. It is also an unusually clean example of why compression must not become authority.

Equality is a stopping rule

The mechanism starts with the LSP identifier, sequence number, checksum, length and other fragment identity material, calculates a 64-bit SipHash value, then XORs fragment hashes into node and range summaries. The draft explicitly says cryptographic security is not the concern of this incremental construction. ASH security instead relies on the mechanisms protecting IS-IS PDU integrity.

Those sentences define two separate jobs. The range hash makes difference location cheaper. IS-IS authentication protects the control packet under the configured keying model. Neither job establishes that the advertised link state corresponds to the physical network. A compromised but authenticated router can distribute false state; two peers can agree perfectly on the same false state; and a correct database can still fail to produce the intended forwarding result.

The accurate statement is narrow: a matching ASH range gives the receiver no detected difference under this algorithm at this moment. It does not say who was entitled to originate every LSP, whether the parser implemented the draft correctly, whether SPF selected the intended path, whether the FIB installed it or whether a packet arrived.

Revision 01 moves the gate

The first revision removes a dedicated zero-length ASH capability TLV. It now asks for an ASH Support bit inside the separate, still-draft Hello Capability TLV. Every node on an adjacency must advertise the bit before ASH is used. A node may nevertheless receive ASH and continue replying with ordinary CSNP or PSNP packets.

That change avoids inventing a feature-specific container, but it creates a visible dependency. The generic draft still has TBD codepoints and special parsing rules: undefined or omitted bits mean zero, and only the first Hello Capability TLV may carry a non-zero bit mask. An operator therefore needs evidence for the precise pair of draft versions, not a product sheet saying “ASH capable.”

Revision 01 also corrects the packet description. A 20-octet range entry means no more than twelve entries fit in one 255-byte TLV value. A normal packet may need several Node Range Hash TLVs, which receivers must concatenate into one sorted logical sequence. That is exactly the kind of boundary at which two individually reasonable implementations can disagree.

Failure paths preserve the old truth test

The proposal is strongest when it refuses to turn ambiguity into success. CASH gaps mean missing state and trigger flooding. Overlapping ranges are treated as zero-hash coverage. Out-of-bounds ranges are clamped and forced down the fallback path. Reversed ranges are discarded and should be logged. At a single-node mismatch, ordinary SNP exchange or direct flooding returns.

Compression is tunable too. One enormous range maximizes savings but magnifies the effect of a lost packet and makes refinement coarser. More ranges trade some efficiency for smaller fault domains. The draft reports no detected collision for its chosen 64-bit variant in its simulation, but simulation is evidence about a model, not a guarantee about all implementations and inputs.

Sources

  1. IETF Datatracker document record
  2. IS-IS Aggregated SNP Hash Packets, revision 01
  3. IS-IS Aggregated SNP Hash Packets, revision 00
  4. IS-IS Hello Capability, revision 00
  5. RFC 1195: Use of OSI IS-IS for Routing in TCP/IP and Dual Environments
  6. RFC 5304: IS-IS Cryptographic Authentication
  7. RFC 5310: IS-IS Generic Cryptographic Authentication
  8. RFC 2119: Requirement-Level Keywords
  9. RFC 8174: Uppercase and Lowercase Requirement Keywords
  10. Minimum Initial Specification, Localized Future Decision, and Voluntary Adoption
  11. On Reality Layers, Symbolic Power, and Why Clarity Feels So Hostile
  12. Running-Code Primacy