Summary

  • PROBE asks a reachable proxy about another interface; for a remote directly connected interface, the reply reports the proxy's ARP or Neighbor Cache state, not an answer generated by that interface.
  • A zero reply code, a ping-like line and a short round-trip time can all be correct while still failing to prove end-to-end reachability, application health or recovery.

The line looked reassuring: bytes returned, a sequence number, a time-to-live and a short round-trip time. At the end sat three more fields—active=1 ipv4=0 ipv6=0. An operator scanning a crowded incident console read the familiar silhouette of successful ping output and moved the circuit into the recovered column.

But this was not ping. The target interface had not answered the probing node. A proxy had answered, and the two protocol bits that mattered were both clear.

This is not a claim about a named outage. It is a reconstructed operating-room pattern taken from the deployment lesson in revision 06 of PROBE: A Utility for Probing Interfaces. The draft records that early clients displayed replies in a form resembling ping. Because people recognize patterns before they parse every field, a mostly familiar success line could dominate the actual interface state. The document now recommends explicit human-readable translations.

That small presentation failure carries a larger leadership lesson. PROBE closes a diagnostic gap by moving the witness. It can query an interface when the probing node lacks bidirectional connectivity to that interface. The price of that reach is provenance: the answer is bounded by what the proxy knows.

One word, two evidence models

PING sends an Echo Request to the probed interface and treats the returning Echo Reply as evidence of bidirectional connectivity between the two endpoints. PROBE sends an ICMP Extended Echo Request to a proxy interface instead. Bidirectional connectivity is required from the probing interface to the proxy, not from the probing interface to the interface being described.

The request carries an Interface Identification Object and an L-bit. With L set, the named interface resides on the proxy node. The proxy reads its local operational state. RFC 8343 defines oper-status=up as ready to pass packets; PROBE turns only that value into the A-bit for active. Down, testing, unknown, dormant, not-present and lower-layer-down all become inactive in this compact report.

With L clear, the named interface is on a directly connected node. Here the proxy does not ask the remote interface to testify. It looks in its own IPv4 ARP table or IPv6 Neighbor Cache. If the address is absent, the reply says No Such Table Entry. If present, the State field carries the table state.

Those paths should never be flattened into a generic interface_ok=true. A local A-bit is the proxy node's operational state for one of its interfaces. A remote State value is the proxy's current knowledge of a neighbor. They are different observations with different clocks and failure modes.

A cache state is a timed statement

RFC 4861 gives the IPv6 states precise meanings. REACHABLE means the proxy recently received positive confirmation that the forward path to the neighbor worked. STALE means that confirmation has aged out; reachability is no longer known, and verification waits until traffic is sent. DELAY gives upper layers time to produce evidence. PROBE means Neighbor Solicitations are actively seeking confirmation. INCOMPLETE means address resolution has not finished.

An entry's existence is therefore not timeless proof that the interface is reachable. Nor does STALE mean the link is certainly broken. The useful fact is narrower: at the reply time, this proxy held this state under its Neighbor Unreachability Detection history.

IPv4 supplies a similar custody question through the proxy's ARP table, although the draft's State vocabulary follows the enumerated reply format. In both families, the operator must preserve the proxy, network instance, address and observation time. A later table lookup cannot reconstruct what the proxy knew when the decision was made.

Identity can also remain unresolved. Reused link-local addresses may yield no entry, one entry without saying which neighbor it belongs to, or multiple matches. Code 4 correctly reports that multiple interfaces satisfy the query. It does not choose an identity for the operator.

Code zero is processing success

The reply codes distinguish malformed query, nonexistent local interface, absent table entry and multiple matches. Code 0 is No Error. It means none of those processing conditions applied. It does not mean the application is healthy, the reverse path exists, the service recovered or every returned bit indicates success.

The same discipline applies to timing. The draft's sample application emits iterative queries and may show round-trip time. Its manageability section explicitly says that time belongs to the path between probing node and proxy node. It is not a latency measurement of the probed interface. A fast proxy can describe an unhealthy neighbor quickly.

This is a classic Reality Layers problem. The protocol layer can be valid, the proxy transport can be fast, and the local table can be faithfully encoded while the service layer remains failed. Running-Code Primacy does not discard the standardized receipt. It assigns the receipt to the layer that actually produced it.

Access control is part of the meaning

PROBE is disabled by default. An operator must enable Extended Echo, select permitted L-bit settings and query types, and authorize source prefixes. Unsupported requests are silently discarded. A timeout may therefore mean policy, filtering, implementation absence, rate limiting or packet loss. It is not a unique diagnosis.

The restrictions exist because the tool can reveal interface names, addresses, counts and clues about bandwidth, vendor or operating system. Revision 06 extends the isolation rule across VPNs, network instances and logical network elements: if proxy and probed interfaces cross those boundaries, the answer must be No Such Interface. An authorization receipt and instance identity belong beside the technical result.

An ICMP checksum is not an authenticity seal. The draft says an on-path attacker can alter requests or replies and recommends IPsec when integrity is required. A high-consequence workflow must therefore distinguish “well-formed packet received” from “trusted report from the intended proxy.”

The migration is semantic, not wire-breaking

Revision 06 is an active INTAREA Working Group Internet-Draft with a Standards Track header. It proposes to obsolete RFC 8335, but has not yet done so. The draft says known RFC 8335 implementations remain compatible because the changes clarify format and processing without changing on-wire behavior.

The most revealing addition is operational memory. Calling the tool ping-like encouraged implementers to take format shortcuts that conflicted with RFC 4884 and encouraged operators to read output by shape. This is Minimum Initial Specification in practice: a small interoperable message still needs unambiguous presentation and bounded claims. Compactness is not permission to erase provenance.

The record is also candid about maturity. Individual experiments have crossed parts of the public Internet, but there are no broad experimental results. Nothing in the frozen sources establishes wide deployment, performance, or a named production recovery.

The receipt an operator can defend

For every automated use, retain:

  1. probing node and interface, proxy node and interface, and request/reply time;
  2. the probed-interface identifier, identification type and L-bit;
  3. reply Code, State and A/4/6 bits without collapsing them;
  4. authorized source prefix, network instance and feature configuration;
  5. implementation and document revision used to interpret the packet;
  6. independent link, forwarding and application evidence; and
  7. the decision, owner, threshold and rollback path.

The right decision rule is simple: a PROBE reply can advance an investigation, but it cannot by itself certify end-to-end reachability or recovery. The proxy is a valuable witness. It is not the interface, the path or the service.

Sources